Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Routenplaner & Karten Holen [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Default search engine hijacked to g-maps.com via chrome_settings_overrides — classic monetization shell.
• Uninstall and install URL hijack both active; traffic capture on install and removal events.
• Privacy policy admits data collection and third-party sharing but is not scoped to this extension.
• Developer domain dy1.com flagged as throwaway-looking; low-install (4) high-capability extension.

Evidence

• search_provider_override manifest chrome_settings_overrides sets g-maps.com as default search engine with is_default=true.
• uninstall_url_hijack crx uninstall_url_hijack=true; captures user traffic on removal.
• install_url_hijack crx install_url_hijack=true; opens third-party page on install.
• throwaway_domain api threat_intel.developer_domain_info.looks_throwaway=true for dy1.com.
• privacy_policy_not_scoped api Policy fetched but scope_extension=false; data_collection=true, third_party_sharing=true — D rule applies.
• external_js_host crx js_external_hosts=[g-maps.com]; same domain as search redirect target.
• no_csp manifest content_security_policy=null; csp_present=false on MV3 extension.
• very_low_installs store Only 4 installs; near-zero user base suggests early-stage or test deployment.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Routenplaner & Karten Holen [browser-hijack] + malext.io malicious_extension_sentry; score 5.85 -> 8.35 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Stores local extension data; minimal standalone risk.
• chrome_settings_overrides.search_provider (is_default=true) high Hijacks default search engine to g-maps.com; primary monetization vector.

Pillar Scores

Bookkeeping