Top Risks

• Default search engine hijacked to bestfreemaps.com — clear ad-monetization shell pattern.
• Privacy policy admits data collection + 3rd-party sharing but is not scoped to this extension.
• Uninstall URL hijack AND install URL hijack both flagged — aggressive user-tracking lifecycle.
• Extension name/email domain mismatch (QwerPDF vs earth3dmaps.com) suggests throwaway alias.
• No CSP on MV3 extension with external JS host (earth3dmaps.com) and search override.

Evidence

• search_provider_override manifest chrome_settings_overrides sets is_default=true, redirecting searches to bestfreemaps.com/earthmaps.php.
• uninstall_url_hijack crx uninstall_url_hijack=true; extension registers an uninstall URL callback to a 3rd-party target.
• install_url_hijack crx install_url_hijack=true; extension opens a 3rd-party URL on first install.
• privacy_policy_scope_mismatch api Policy fetched from earth3dmaps.com; scope_extension=false, data_collection=true, third_party_sharing=true.
• developer_domain_mismatch store Developer email @qwerpdf.com; privacy policy and JS host on earth3dmaps.com — different domain.
• no_csp manifest content_security_policy is null; csp_present=false despite external JS host earth3dmaps.com.
• external_js_host crx js_external_hosts=[earth3dmaps.com]; scripts loaded from a domain not matching developer identity.
• search_override_monetization manifest Search URL bestfreemaps.com has no relation to stated 'Earth Maps Satellite' functionality — shell pattern.

Permissions Breakdown

• storage low Local key-value storage only; no cross-origin data access.
• chrome_settings_overrides.search_provider (is_default) high Silently hijacks the user's default search engine to bestfreemaps.com — classic monetization vector.

Pillar Scores

Bookkeeping