Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Planet Search [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Search provider override routes all user queries to planet-search.com, a third-party domain controlled by a VPN operator.
• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection and third-party sharing (Privacy pillar maxes out at 10).
• 21 months since last update; stale extension with 2M installs creates broad unmonitored attack surface.
• Developer name blank; freevpnplanet.com email mismatches search-tool branding, raising intent ambiguity.

Evidence

• search_provider_override manifest chrome_settings_overrides sets is_default=true, routing all searches to https://planet-search.com/search/?q={searchTerms}.
• generic_privacy_policy store Privacy URL is Google's own policy page; scope_extension=false, data_collection=true, third_party_sharing=true — worst-case privacy score.
• no_developer_name store developer_name is empty string; identity accountability is low.
• stale_large_install_base store 21 months since update with 2M installs; triple-stale check applies (>18mo, MV3 but no update).
• featured_by_google store is_featured_by_google=true provides partial reputation credit but does not explain privacy or identity gaps.
• domain_mismatch store Developer email domain freevpnplanet.com does not match the search product planet-search.com — unrelated product cluster.
• js_external_host crx Only external host is planet-search.com (1 domain, CA geo); no bad-host or monetization hits detected.
• below_average_rating store Rating 3.4 at 2M installs; no review red-flags matched but rating below 4.0 at this scale is a signal.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Planet Search [browser-hijack] + malext.io malicious_extension_sentry; score 4.81 -> 7.31 (+2.5 cap 2.5).

Permissions Breakdown

• chrome_settings_overrides.search_provider medium Overrides default search engine to planet-search.com; is_default=true hijacks all user searches.

Pillar Scores

Bookkeeping