Top Risks

• Default search-engine hijack routes all queries through earthapp.net monetization endpoint (is_default: true).
• Uninstall AND install URL hijacks signal aggressive traffic-monetization shell pattern.
• Gmail developer account (walstab24@gmail.com), no verified publisher, rating=1 — very low trust.
• Privacy policy admits data collection and third-party sharing but is not scoped to this extension (+10 privacy pillar).
• Search-provider override by unverified free-webmail dev is a textbook search-hijacker fingerprint.

Evidence

• search_provider_override manifest chrome_settings_overrides sets earthapp.net as default search; all queries monetized via /admin/public/link?q=
• uninstall_url_hijack crx uninstall_url_hijack=true; aggressive monetization shell pattern confirmed.
• install_url_hijack crx install_url_hijack=true; opens 3rd-party URL on install — classic traffic-monetization signal.
• free_webmail_dev store Developer email walstab24@gmail.com; no verified publisher; developer domain gmail.com.
• rating_1 store Rating=1.0 with 40K installs strongly suggests user complaints about search hijacking.
• privacy_policy_unscoped_admits_sharing api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — D rule applies: +10.
• cookies_permission manifest cookies permission paired with search override enables session-level tracking of all searches.
• no_csp manifest content_security_policy=null; MV3 strict default applies, mitigates eval risk but not search hijack.

Permissions Breakdown

• storage low Standard local data persistence; low standalone risk.
• cookies high Enables cookie read/write on earthapp.net; combined with search override enables user tracking.
• host_permissions: *://earthapp.net/* medium Scoped to dev domain; necessary for search/suggest but enables cookie and fetch access.
• chrome_settings_overrides.search_provider (is_default: true) high Silently replaces default search engine; all user queries monetized through earthapp.net.

Pillar Scores

Bookkeeping