Top Risks

• Search engine override (is_default=true) silently redirects all user queries to operator-controlled domain.
• Developer name 'Watch Movies Online' is completely unrelated to a maps product — strong category mismatch / deceptive shell.
• Uninstall URL hijack and install URL hijack both set to operator domain — monetization/surveillance pattern.
• Free-webmail developer (kthill8080@gmail.com) with no verified identity; rating 1.6 on 30K installs signals user dissatisfaction.
• Installs > 10K with deceptive category mismatch amplifies blast radius of search-hijack monetisation.

Evidence

• search_provider_override_default manifest chrome_settings_overrides.search_provider.is_default=true routes all searches to getdirectionsmaps.com/auto-suggest/search.php
• developer_name_mismatch store Developer listed as 'Watch Movies Online' for a maps/directions extension — clear category mismatch.
• uninstall_url_hijack crx uninstall_url_hijack=true; operator captures uninstall events for monetisation/re-engagement.
• install_url_hijack crx install_url_target=https://getdirectionsmaps.com/extension-success/ opens operator page on install.
• free_webmail_developer store Developer email kthill8080@gmail.com — numbered alias gmail, no verified business identity.
• low_rating store Rating 1.6 on 30K installs; user dissatisfaction consistent with unwanted search hijack behaviour.
• privacy_policy_adequate api Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true — fully scoped.
• no_high_code_findings crx code_findings_raw empty, obfuscation_score=0.0; JS surface minimal (2 files).

Permissions Breakdown

• chrome_settings_overrides.search_provider (is_default=true) high Hijacks default search engine to getdirectionsmaps.com; all user searches routed through operator.

Pillar Scores

Bookkeeping