Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Smart New Search [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Search provider override routes all queries through smart-new-search.com intermediary (ad monetization redirect).
• Uninstall URL hijack sends uninstall event to third-party domain.
• Install URL hijack opens third-party thank-you page on installation.
• Privacy policy admits data collection and third-party sharing with no retention period disclosed.

Evidence

• search_provider_override manifest chrome_settings_overrides sets default search to smart-new-search.com/api/get-redirection — ad monetization intermediary.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL points to smart-new-search.com/uninstall — tracks user churn for monetization operator.
• install_url_hijack crx onInstalled opens smart-new-search.com/thankyou — install event tracked by operator domain.
• privacy_policy_scope api Policy fetched; scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• verified_publisher store clicksco.com is verified publisher; domain resolves, not throwaway — partial trust credit applied.
• no_developer_name store developer_name field empty; only email chrome.dev.admin@clicksco.com provided.
• low_install_count store Only 11 installs — newly deployed or test deployment; tail-attack-surface not flagged by anomaly check.
• cve_findings_raw_empty crx No CVEs found; no JS libraries detected; obfuscation_score=0.0; code_findings_raw empty.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Smart New Search [browser-hijack] + malext.io malicious_extension_sentry; score 3.42 -> 5.92 (+2.5 cap 2.5).

Permissions Breakdown

• chrome_settings_overrides.search_provider (default) medium Overrides default search engine to redirect via smart-new-search.com intermediary — monetization vector.

Pillar Scores

Bookkeeping