Top Risks

• Search provider override redirects ALL omnibox queries to chromecrxstore.com masquerading as Google — classic search hijack.
• Privacy policy URL returns fetch error; effectively no policy for 6,000 users; Privacy pillar = 10.
• Developer is free-webmail Gmail with no verified business identity and YouTube brand impersonation confirmed.
• install_url_hijack=true: extension opens 3rd-party URL on install — monetization/tracking pattern.
• Extension name/branding impersonates YouTube (Google property) without authorization.

Evidence

• search_provider_override manifest chrome_settings_overrides sets default search to chromecrxstore.com/query/ while labeling it 'Google' with Google keyword.
• brand_impersonation store brand_mention.is_impersonation=true for 'youtube'; developer domain is gmail.com, confirmed_owner=false.
• privacy_policy_unfetchable api privacy_policy_classification.fetched=false (HTTPError); policy on chromecrxstore.com is inaccessible — treated as no policy.
• install_url_hijack crx install_url_hijack=true; extension opens 3rd-party page on install — monetization/tracking pattern.
• free_webmail_dev store Developer email js8231437@gmail.com — numbered alias on free webmail with no verified business.
• js_external_hosts crx Extension contacts chromecrxstore.com (operator's own ad/redirect domain) and music.youtube.com.
• search_override_medium_permission manifest chrome_settings_overrides.search_provider scored as MEDIUM (~+1.0) per rubric 2a, elevated by is_default=true hijack.
• maintenance_stale store months_since_update=7; falls in 6-12mo band (+3.5 maintenance score).

Permissions Breakdown

• storage low Stores local extension state; low standalone risk.
• contextMenus low Adds right-click menu items; no data exfil capability alone.
• chrome_settings_overrides.search_provider (is_default=true) high Silently overrides default search to chromecrxstore.com — disguised as Google, hijacks all omnibox searches.

Pillar Scores

Bookkeeping