Top Risks

• Default search provider override redirects all user searches to bestfreemaps.com — monetization hijack.
• Uninstall URL hijack and install URL hijack both present — aggressive lifecycle hooking.
• Developer domain dy1.com flagged as throwaway; low accountability.
• Privacy policy admits data collection and third-party sharing but omits retention details.
• External JS from earth3dmaps.com with no CSP — remote code trust risk.

Evidence

• search_provider_override manifest chrome_settings_overrides sets is_default=true pointing to bestfreemaps.com — all searches redirected.
• uninstall_url_hijack crx uninstall_url_hijack=true; target unknown. Lifecycle manipulation detected.
• install_url_hijack crx install_url_hijack=true; target unknown. Opens 3rd-party page on install.
• throwaway_developer_domain api threat_intel.developer_domain_info.looks_throwaway=true for dy1.com.
• external_js_host crx JS loaded from earth3dmaps.com with csp_present=false — remote code execution surface.
• privacy_policy_third_party_sharing api Policy admits data collection + third-party sharing; retention not disclosed.
• no_ratings store Rating=0, rating_count=0 across 2000 installs — trust signal absent.
• unverified_publisher store verified_publisher=false, is_featured_by_google=false; no organizational accountability.

Permissions Breakdown

• storage low Stores local extension state; low risk in isolation.
• chrome_settings_overrides.search_provider (is_default=true) medium Forces default search to bestfreemaps.com, hijacking all browser search queries.

Pillar Scores

Bookkeeping