Top Risks

• Privacy policy is Google's own policy, not scoped to this extension — admits data collection and third-party sharing: +10.0 privacy.
• 34-month staleness (>24 mo) triggers zombie maintenance score; no updates since Nov 2023.
• Search-provider override sets meta.softwarejourney.net as default, routing all searches through developer-controlled host.
• Brand impersonation: name uses 'Meta' but developer has no affiliation with Meta Platforms (confirmed_owner=false).
• Uninstall and install URL hijack flags set; extension opens 3rd-party URLs on install/uninstall events.

Evidence

• search_provider_override manifest chrome_settings_overrides sets meta.softwarejourney.net as default search, routing all user queries to dev-controlled host.
• privacy_policy_generic_google store Privacy URL is Google's account policy (scope_extension=false, data_collection=true, third_party_sharing=true): +10 privacy.
• maintenance_stale store 34 months since last update; falls in >24mo band (+8.5). Zombie with <10K installs.
• brand_impersonation store Title uses 'Meta'; brand_mention.is_impersonation=true, confirmed_owner=false. +2.0 reputation.
• uninstall_and_install_hijack crx uninstall_url_hijack=true and install_url_hijack=true; opens 3rd-party pages on lifecycle events.
• multi_search_engine_newtab_analog crx js_external_hosts includes 6 search engines (bing, google, duckduckgo, brave, ecosia, qwant); search_engine_count=6.
• verified_publisher_featured store verified_publisher=true and is_featured_by_google=true; discounts apply but capped due to staleness >18mo (v3.5 invariant 0c).
• no_developer_name store developer_name is empty string; reduces accountability signal.

Permissions Breakdown

• declarativeContent low Allows page-state matching for icon display; no data access.
• chrome_settings_overrides.search_provider (is_default=true) medium Sets extension's own domain as default search engine; redirects all searches.

Pillar Scores

Bookkeeping