Top Risks

• Privacy policy fetched but scope_extension==false and third_party_silence==true; policy not scoped to this extension.
• Search provider override sets Qwant as default engine; behavioral change beyond pure tracker-blocking.
• No CSP declared (MV3 so no +2.0 network penalty, but no inline-script protection).
• Developer name field is empty; attribution relies solely on email domain qwant.com.
• Not a verified publisher; featured badge present but limited accountability signal.

Evidence

• search_provider_override manifest chrome_settings_overrides sets Qwant as default search engine (is_default: true).
• privacy_policy_not_scoped api Policy fetched (40 391 chars) but scope_extension==false, data_collection==false, third_party_silence==true.
• no_csp crx content_security_policy is null; MV3 default applies but no explicit hardening.
• featured_by_google store is_featured_by_google==true reduces reputation risk somewhat.
• no_bad_hosts_no_cves crx cve_findings_raw=[], bad_host_hits=[], affiliate_hits=[], code_findings_raw=[] all empty.
• developer_name_missing store developer_name is empty string; identity relies on contact@qwant.com domain.
• maintenance_ok store Last updated November 2025; 7 months since update — 3-6 month band (+1.5).
• obfuscation_clean crx obfuscation_score==0.0, js_external_hosts=[], 2 JS files scanned with no findings.

Permissions Breakdown

• declarativeNetRequest medium Allows blocking/redirecting network requests; core to tracker-blocking but moderate capability.
• webNavigation medium Observe navigation events across tabs; can infer browsing patterns.
• storage low Local extension data storage only.
• tabs medium Access to tab URLs and metadata; can observe browsing activity.
• chrome_settings_overrides.search_provider medium Sets Qwant as default search engine; legitimate for the stated purpose but is a settings override.

Pillar Scores

Bookkeeping