Top Risks

• Search provider override routes all queries through landing.airsearch.co proxy with results by Yahoo — monetization intermediary.
• Privacy policy (airfind.com) is not scoped to this extension; admits data collection and third-party sharing.
• Extension is 29 months stale with no update — zombie fingerprint.
• Developer name absent; privacy policy domain (airfind.com) differs from developer domain (broadburst.io).
• Install URL hijack on install opens third-party landing page (landing.airsearch.co/thank-you).

Evidence

• search_provider_override manifest chrome_settings_overrides sets default search to https://landing.airsearch.co/api/search?q={searchTerms} (Yahoo-branded proxy).
• install_url_hijack manifest onInstalled opens https://landing.airsearch.co/thank-you — third-party monetization page.
• privacy_policy_not_scoped api Policy at airfind.com fetched; scope_extension=false, data_collection=true, third_party_sharing=true.
• stale_extension store Last updated March 2024; 29 months since update — zombie tier.
• no_developer_name store developer_name is empty string; no verified publisher badge.
• js_external_hosts crx External JS hosts: airfind.com, landing.airsearch.co — both linked to search monetization operator.
• low_install_count store Only 837 installs, zero ratings — minimal trust signal, tail-attack surface.
• privacy_policy_domain_mismatch store Dev email @broadburst.io; privacy policy at airfind.com — different organizational identity.

Permissions Breakdown

• chrome_settings_overrides.search_provider (is_default=true) medium Overrides default search engine to airsearch.co proxy; intercepts all user searches.

Pillar Scores

Bookkeeping