Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Launch Extension [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Search provider override routes queries through click.launch.am geo-redirect to Yahoo — monetization intermediary.
• NewTab override + search override combo: high user engagement surface for ad-monetization.
• Brand impersonation: uses Twitch branding but developer domain is launch.am (unconfirmed Twitch affiliation).
• Privacy policy not scoped to this extension and does not disclose data collection; third-party sharing silence.

Evidence

• search_provider_override manifest Default search set to geo_redirect.php via click.launch.am then Yahoo; classic affiliate/monetization chain.
• newtab_override manifest chrome_url_overrides.newtab = iframe.html; replaces every new tab for all users.
• brand_impersonation store brand_mention.is_impersonation=true for Twitch; developer domain launch.am not confirmed Twitch owner.
• privacy_policy_inadequate api Policy fetched but scope_extension=false, data_collection=false, third_party_silence=true; not extension-scoped.
• stale_extension store 22 months since last update with active search/newtab monetization surface.
• install_url_hijack crx install_url_hijack=true; opens URL on install (target not captured).
• dom_xss_sink crx innerHTML user-controlled sink in index.js; no CSP present on MV3 extension.
• search_redirect_probe api Probe shows final redirect to search.yahoo.com via click.launch.am intermediary; is_direct_provider=true per probe.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Launch Extension [browser-hijack] + malext.io malicious_extension_sentry; score 4.97 -> 7.47 (+2.5 cap 2.5).

Permissions Breakdown

• identity low OAuth token access; low risk without scopes specified.
• notifications medium Can display system notifications; medium nuisance/phishing vector.
• alarms low Schedules background tasks; low direct risk.
• storage low Local data persistence only.
• idle low Detects user idle state; minimal risk.
• chrome_url_overrides.newtab medium Replaces new-tab page; high engagement surface, monetization vector.
• chrome_settings_overrides.search_provider high Sets default search to geo-redirect via click.launch.am/Yahoo; monetization override.
• host_permissions:https://id.twitch.tv/oauth2/* medium Twitch OAuth endpoint; limited to auth flow.
• host_permissions:https://api.twitch.tv/helix/* medium Twitch API; scoped to Twitch data only.

Pillar Scores

Bookkeeping