Top Risks

• Search provider override sets user's default search to a sponsored-results page without informed consent.
• Privacy policy admits data collection and third-party sharing but is not scoped to this extension — GDPR/CCPA red flag.
• Uninstall URL hijack and install URL hijack redirect users to onlinesearchtool.org/hometab/ on install/removal.
• Cookies permission paired with search override enables persistent user tracking across all queries.
• No CSP declared (MV3 default strict, but no explicit policy) and no rating/reviews for social validation.

Evidence

• search_provider_override manifest chrome_settings_overrides sets OnlineSearchTool as default search; search_url routes queries to onlinesearchtool.org with sponsored results.
• install_url_hijack manifest install_url_hijack=true; onInstalled opens https://onlinesearchtool.org/hometab/ — monetization redirect on install.
• uninstall_url_hijack manifest uninstall_url_hijack=true; setUninstallURL to 3rd-party target — webstore +3.0 signal.
• privacy_policy_generic_with_sharing api Policy fetched: scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 privacy pillar (v3.5 rule D).
• cookies_permission manifest cookies declared alongside search override and host_permissions for dev domain — tracking capability confirmed.
• no_ratings store Rating=0, rating_count=0 — no community validation; 5,000 installs with zero reviews is anomalous.
• no_cve_findings crx cve_findings_raw empty; no bundled JS libraries detected; CVE pillar=0.
• developer_domain_resolves api onlinesearchtool.org resolves, looks_throwaway=false; no bad_host or affiliate hits found.

Permissions Breakdown

• storage low Standard local storage, low intrinsic risk.
• cookies high Can read/write cookies scoped to onlinesearchtool.org; combined with search override enables session tracking.
• *://*.onlinesearchtool.org/* medium Host permission scoped to dev domain; enables request interception and cookie access on all subdomains.
• chrome_settings_overrides.search_provider (is_default:true) high Forces default search to onlinesearchtool.org with sponsored results — classic search-hijack monetization.

Pillar Scores

Bookkeeping