Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and 3rd-party sharing (scores max privacy risk).
• Extension is 36 months stale (last updated Sep 2023) — at zombie threshold with 80K installs.
• Default search engine override redirects all searches to presearch.com without user-visible data-handling disclosure.
• No developer name listed in store; verified publisher but anonymous display reduces accountability.
• v2.1 calibration: triple-stale fingerprint (36mo + MV3 + no CVEs) — maintenance at maximum.

Evidence

• search_provider_override manifest chrome_settings_overrides sets presearch.com as default search engine with is_default=true.
• privacy_policy_generic store Privacy URL points to Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → max privacy score.
• maintenance_stale store Last updated Sep 4 2023; months_since_update=36 — at 36-month boundary scoring 10.0.
• verified_publisher store Verified publisher badge present; presearch.io resolves, domain age 3365 days, not throwaway.
• no_developer_name store developer_name is empty string; reduces accountability despite verified publisher status.
• clean_code crx 1 JS file scanned, code_findings_raw empty, obfuscation_score=0.0, no external JS hosts.
• no_cves crx cve_findings_raw empty; no bundled vulnerable libraries detected.
• install_count store 80,000 installs; +1.0 webstore signal for >10K reach.

Permissions Breakdown

• chrome_settings_overrides.search_provider (is_default=true) medium Overrides the default search engine to presearch.com; MEDIUM per rubric for search_provider override.
• content_scripts: *://*.presearch.com/* low Narrow host scope limited to presearch.com only; minimal reach beyond developer's own domain.

Pillar Scores

Bookkeeping