Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — View Menu with Prices [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Default search engine override routes all user searches to developer-controlled domain (viewmenuprices.com).
• Uninstall URL hijack confirmed — tracks user uninstall events via third-party redirect.
• Install URL hijack opens developer site on install — monetization/tracking pattern.
• Privacy policy admits third-party data sharing but lacks retention disclosure.

Evidence

• search_provider_override manifest chrome_settings_overrides sets is_default=true; all searches routed to viewmenuprices.com/auto-suggest/search.php
• uninstall_url_hijack crx uninstall_url_hijack=true; target null but hijack flag set — tracks uninstall lifecycle.
• install_url_hijack crx install_url_hijack=true; target https://viewmenuprices.com/extension-success/ — monetization/redirect pattern.
• privacy_policy_third_party_sharing api Policy fetched: scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false, rating=0 with 0 reviews.
• maintenance_stale store months_since_update=7; falls in 3-6 month band (+1.5).
• webstore_install_count store 10,000 installs with search-override monetization shape raises blast-radius concern.
• csp_absent_mv3 manifest content_security_policy=null; MV3 provides strict default so no network penalty applied.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — View Menu with Prices [browser-hijack] + malext.io malicious_extension_sentry; score 4.72 -> 7.22 (+2.5 cap 2.5).

Permissions Breakdown

• chrome_settings_overrides.search_provider (is_default=true) medium Overrides default search engine to developer-controlled endpoint; intercepts all user searches.

Pillar Scores

Bookkeeping