Top Risks

• Default search hijack routes all queries through earth3d.net/admin/public/link — full query surveillance.
• Privacy policy admits data collection and third-party sharing without scoping to this extension (→ Privacy +10).
• Developer email is free-webmail (gmail); no verified publisher; rating is 1/5.
• Uninstall and install URL hijacks flagged — onboarding/offboarding manipulation confirmed.
• 13-month-stale MV3 extension with cookies + search override = persistent tracking capability.

Evidence

• search_provider_override manifest chrome_settings_overrides sets earth3d.net as default search; all queries exfiltrated to /admin/public/link.
• uninstall_url_hijack store uninstall_url_hijack=true; extension registers an uninstall URL redirect.
• install_url_hijack store install_url_hijack=true; extension opens a URL on installation.
• free_webmail_developer store Developer email edgarlife1980@gmail.com; no verified publisher; no recognized org.
• privacy_policy_scope_fail api Policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true — generic data-sharing admission.
• low_rating store Rating 1/5; 40,000 installs indicates large blast radius with poor user satisfaction.
• stale_extension store Last updated July 2025 but months_since_update=13; maintenance pillar elevated.
• cookies_with_search_override manifest cookies permission combined with default search override enables persistent cross-session query tracking.

Permissions Breakdown

• storage low Standard local persistence; low standalone risk.
• cookies high Can read/write cookies; paired with search-override enables session tracking.
• host_permissions: *://earth3d.net/* low Scoped to own domain only; limited reach.
• chrome_settings_overrides.search_provider (is_default: true) high Overrides default search engine; all queries routed through earth3d.net.

Pillar Scores

Bookkeeping