Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — 3D Street View [adware] [divergent] + malext.io malicious_extension_sentry (+2.5, capped).
• Default search-provider override routes all user searches through 3dstreetview.com — classic monetization hijack.
• Uninstall and install URL hijack flags set; extension manipulates lifecycle events for traffic purposes.
• Developer uses free Gmail address (christyside2@gmail.com) with no verified publisher badge — low accountability.
• Rating of 1.0 is a strong user-dissatisfaction signal consistent with search-hijack complaints.

Evidence

• search_provider_override_default manifest chrome_settings_overrides sets is_default=true, routing all searches via 3dstreetview.com/admin/public/link.
• uninstall_url_hijack store uninstall_url_hijack=true; extension registers lifecycle hook on uninstall.
• install_url_hijack store install_url_hijack=true; extension opens URL on install — monetization pattern.
• free_webmail_developer store Developer email christyside2@gmail.com; no verified publisher; domain_age_ct not queried.
• low_rating store Rating=1.0 — extreme dissatisfaction consistent with search-hijack user complaints.
• stale_extension store Last updated April 2025 but months_since_update=16 (scored as provided).
• privacy_policy_adequate api Policy fetched, scope_extension=true, data_collection=true, retention=true, third_party_sharing=true.
• no_cve_no_bad_hosts crx cve_findings_raw and bad_host_hits both empty; code_findings_raw empty; obfuscation_score=0.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — 3D Street View [adware] [divergent] + malext.io malicious_extension_sentry; score 4.73 -> 7.23 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Local data persistence; minimal risk on its own.
• host_permissions: *://3dstreetview.com/* low Scoped to developer's own domain only; not broad.
• chrome_settings_overrides.search_provider (is_default: true) medium Sets extension as default search provider, redirecting all searches through dev's endpoint.

Pillar Scores

Bookkeeping