Top Risks

• Privacy policy fetched but length=20 chars, scope_extension=false, data_collection=false — effectively non-disclosure (score +9.0).
• Uninstall URL hijack present — onUninstall redirects to a third-party URL (+3.0 webstore).
• No CSP + 7 files with innerHTML user-controlled DOM sinks across all scripts, amplifying XSS risk.
• 2M-user AI extension injects content scripts on virtually every major search engine globally — high-reach data exposure potential.
• Unverified developer, no featured-publisher badge, AI category processing search-page content.

Evidence

• uninstall_url_hijack crx uninstall_url_hijack=true — extension registers 3rd-party uninstall redirect (+3.0 webstore).
• privacy_policy_too_short api Policy fetched, length=20 chars, scope_extension=false, data_collection=false → effectively non-disclosure (+9.0 privacy).
• no_csp crx content_security_policy=null; MV3 has strict default but no explicit CSP hardens XSS sinks.
• dom_xss_sinks_widespread crx 7 of 8 JS files contain innerHTML user-controlled sinks; no CSP present — DOM-XSS risk elevated (+2.0 code).
• ai_extension_high_reach store AI category, 2M installs, content scripts on 200+ search domains — high data-access blast radius (+2.5 webstore).
• is_featured_by_google store Extension carries Google Featured badge — partial reputation credit (-2.0 reputation).
• no_verified_publisher store verified_publisher=false; developer identity limited to aichat4search.com domain.
• third_party_silence api Privacy policy does not mention third-party sharing (+1.0 privacy, but already near cap).

Permissions Breakdown

• storage low Stores local extension data; low risk.
• scripting medium Allows programmatic script injection into pages; elevated capability.
• unlimitedStorage low Removes storage quota cap; minor risk.
• sidePanel low UI panel only; no data-access capability.
• host_permissions: https://*.openai.com/ medium Can read/write to all OpenAI subdomains; matches stated AI chat function.
• content_scripts on 200+ search engine TLDs medium Broad search-page reach; consistent with AI-on-search use case but high REACH.

Pillar Scores

Bookkeeping