Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — FedEx Tracking [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Search-provider override forces all queries through trackingnumbers.org, a known monetization vector.
• Uninstall and install URL hijacks redirect users to third-party pages on install/remove.
• Extension title is 'FedEx Tracking' but developer name is 'USPS Tracking' — clear brand confusion / impersonation pattern.
• Free-webmail developer (gmail) with no verified business identity controls 30,000 users' default search.

Evidence

• search_provider_override_is_default manifest chrome_settings_overrides sets trackingnumbers.org as default search engine with keyword FedexTracking.
• uninstall_url_hijack crx uninstall_url_hijack=true; extension redirects browser on uninstall to third-party URL.
• install_url_hijack crx install_url_hijack=true; extension opens third-party page on install.
• developer_name_mismatch store Extension titled 'FedEx Tracking' but 'Offered by: USPS Tracking' — two rival brand names used simultaneously.
• free_webmail_developer store Developer email morancharles916@gmail.com; no verified business or publisher badge.
• low_rating store Rating 1.7 — well below 3.0 threshold indicating poor user reception.
• cookies_plus_search_override manifest cookies permission combined with default search override enables full query interception and session tracking.
• privacy_policy_adequate api Policy fetched, scope_extension=true, data_collection=true, retention=true, third_party_sharing=true — fully disclosed.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — FedEx Tracking [browser-hijack] + malext.io malicious_extension_sentry; score 5.56 -> 8.06 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Stores local extension data; low standalone risk.
• cookies high Can read/write cookies; combined with search_provider override enables session tracking.
• chrome_settings_overrides.search_provider (is_default=true) high Hijacks default search engine to trackingnumbers.org; core monetization vector.

Pillar Scores

Bookkeeping