Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Handy Tab Search [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Default search engine override routes all searches to tryhandytab.com, enabling traffic monetization.
• Privacy policy is Google's generic account policy — not scoped to this extension; data practices undisclosed.
• 23 months since last update; approaching zombie-tier staleness with no changelog.
• No developer name listed; publisher identity thin despite verified status.

Evidence

• search_provider_override manifest chrome_settings_overrides sets is_default=true, routing all default searches to https://tryhandytab.com/search
• generic_privacy_policy store Privacy URL is Google account policy (479KB); scope_extension=false, data_collection=true, third_party_sharing=true — not scoped to this ext.
• verified_publisher store Extension carries verified publisher badge; caps reputation floor at 2.0 but does not override search-override risk.
• staleness store Last updated September 2024; 23 months ago. Approaching 24-month stale tier (+6.0 Maintenance).
• no_developer_name store developer_name is empty string; no 'Offered by' display name in listing.
• no_js_code crx js_file_count=0, code_findings_raw empty, obfuscation_score=0.0 — extension is pure manifest search override.
• low_installs store Only 46 installs; low blast radius but also low scrutiny for a search-override extension.
• cve_findings_none crx cve_findings_raw empty; no bundled JS libraries detected.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Handy Tab Search [browser-hijack] + malext.io malicious_extension_sentry; score 4.22 -> 6.72 (+2.5 cap 2.5).

Permissions Breakdown

• chrome_settings_overrides.search_provider (is_default: true) medium Overrides user's default search engine to tryhandytab.com; MEDIUM per rubric, scored on overrides even with empty permissions[].

Pillar Scores

Bookkeeping