Top Risks

• Search-provider override routes ALL browser queries to chromecrxstore.com, an unrecognized third-party domain.
• Apple brand impersonation by unverified gmail developer — no connection to Apple Inc confirmed.
• Privacy policy URL returns fetch error; policy effectively absent; third-party data handling undisclosed.
• Free-webmail developer (js8231437@gmail.com), no developer name, no business identity.
• Extension description promises Apple TV search but actual capability is hijacking the default search engine.

Evidence

• search_provider_override manifest chrome_settings_overrides.search_provider is_default=true pointing to chromecrxstore.com/query — full query interception.
• brand_impersonation store brand_mention Apple confirmed; developer gmail.com; confirmed_owner=false; is_impersonation=true.
• privacy_policy_fetch_error api Privacy policy URL https://chromecrxstore.com/privacy-policy returned HTTPError — treated as absent (+10.0 privacy).
• free_webmail_no_dev_name store developer_email js8231437@gmail.com, developer_name empty, no business website verified.
• js_external_host crx JS contacts chromecrxstore.com — same domain as search redirect; not a recognized entity.
• search_provider_mismatch manifest keyword='google' but search_url routes to chromecrxstore.com — keyword deception.
• maintenance_stale store months_since_update=12; falls in 6-12 month band (+3.5).
• verified_publisher_search_override store Verified publisher badge present but search_provider override triggers capability gate — discount capped at -1.0 per v3.5 0c/0b.

Permissions Breakdown

• chrome_settings_overrides.search_provider medium Overrides default search engine to chromecrxstore.com — not a recognized search provider, redirects all queries.

Pillar Scores

Bookkeeping