Top Risks

• Install URL hijack opens searchbyimage.ru on install; uninstall URL sends UTM-tagged beacon — monetization fingerprint.
• Developer email ganes@yandex.ru (free Yandex webmail) with no independently verified business identity.
• Privacy policy confirms data collection AND third-party sharing but no retention period disclosed.
• 13 months since last update (6-12 mo band) with 200K installs increases stale-extension risk.
• No CSP (MV3 default used but host_permissions + external JS hosts increase network surface).

Evidence

• install_url_hijack crx onInstalled opens https://searchbyimage.ru/?i= — third-party install redirect (+2.0 Webstore).
• uninstall_url_hijack crx setUninstallURL to searchbyimage.ru with UTM params — third-party uninstall beacon (+3.0 Webstore).
• developer_email_yandex store ganes@yandex.ru is free-webmail; no verified business; elevated-risk signal (+1.5 Reputation).
• privacy_policy_data_third_party api Policy fetched; scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• is_featured_by_google store Featured badge present — applies -2.0 Reputation discount.
• months_since_update_13 store Last updated May 2025; 13 months puts this in 6-12mo band (+3.5 Maintenance).
• js_external_hosts crx 5 external hosts: searchbyimage.com, searchbyimage.ru, aliexpress.com, google.com, google.ru.
• no_cve_no_obfuscation crx cve_findings_raw empty; obfuscation_score 0.0; code_findings_raw empty — clean code surface.

Permissions Breakdown

• contextMenus low Adds right-click menu items; low standalone risk.
• host: https://*.searchbyimage.com/* low Scoped to developer-owned search service domain.
• host: https://*.searchbyimage.ru/* low Scoped to developer-owned search service domain.

Pillar Scores

Bookkeeping