Top Risks

• Default search provider override routes ALL user search queries through switchmysearch.com with no transparency.
• Privacy policy admits data collection and third-party sharing but is not scoped to this extension — worst-case disclosure.
• 23 months since last update; approaching zombie tier with 9K active users exposed.
• No developer name listed; anonymous operator with unscoped data-sharing policy.
• declarativeNetRequest combined with search override gives silent request-redirection capability.

Evidence

• search_provider_override manifest chrome_settings_overrides sets is_default=true, routing queries to https://switchmysearch.com/ext/search.
• privacy_policy_scope_mismatch api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 privacy (D rule).
• stale_extension store 23 months since update; maintenance score 6.0 (6-24mo band).
• no_developer_name store developer_name is empty string; no verified publisher badge.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 (no v2 penalty but noted).
• search_engine_override_webstore manifest +2.0 Webstore for search-provider override; +1.0 for <10K installs bracket.
• no_bad_hosts_no_cves api threat_intel bad_host_hits and cve_findings_raw both empty; code_findings_raw clean.
• no_obfuscation crx obfuscation_score=0.0; 2 JS files scanned with no findings.

Permissions Breakdown

• storage low Stores user preferences locally; minimal risk.
• declarativeNetRequest medium Can redirect/block network requests; medium risk for a search-switcher.
• chrome_settings_overrides.search_provider (is_default: true) high Sets itself as default search engine, routing all queries through switchmysearch.com.
• host_permissions: https://switchmysearch.com/* medium Narrow host access limited to own domain; enables data exfil of search queries to dev server.

Pillar Scores

Bookkeeping