Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Initial [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Startup-page override to googloc.com hijacks browser homepage on install.
• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Developer uses free Gmail address with no verifiable business identity.
• Install URL hijack opens googloc.com/instalado.htm on every fresh install — unannounced redirect.

Evidence

• startup_page_override manifest chrome_settings_overrides.startup_pages set to https://googloc.com/search/ — changes user's browser startup page.
• install_url_hijack crx install_url_target=https://googloc.com/instalado.htm; onInstalled opens 3rd-party URL without user consent.
• generic_privacy_policy store Privacy URL is Google's account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email appgoogloc@gmail.com; no verified business; brand_mention.developer_domain=gmail.com.
• stale_extension store Last updated October 2024; months_since_update=22 — approaching 24-month high-risk band.
• external_js_host crx js_external_hosts=[googloc.com]; 1 JS file scanned; no findings but external host dependency exists.
• low_install_count store Only 452 installs; small user base limits blast radius but also limits scrutiny.
• no_csp manifest content_security_policy=null; csp_present=false on MV3 extension with external JS host.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Initial [browser-hijack] + malext.io malicious_extension_sentry; score 5.34 -> 7.84 (+2.5 cap 2.5).

Permissions Breakdown

• chrome_settings_overrides.startup_pages medium Overrides browser startup page to googloc.com/search/ — search-provider-adjacent override.

Pillar Scores

Bookkeeping