Top Risks

• Default search engine override routes all searches to searchanything.co (monetization/data collection vector).
• Gmail developer address (devextension546@gmail.com) with no verified business identity; numbered alias pattern.
• 29 months since last update — zombie extension with active search-override capability.
• Content script injected into Yahoo Search pages; declarativeNetRequestWithHostAccess enables request manipulation.
• Uninstall URL hijack configured; extension redirects users on removal.

Evidence

• search_provider_override manifest chrome_settings_overrides sets searchanything.co as default search provider with is_default:true.
• uninstall_url_hijack crx uninstall_url_hijack=true; extension sets an uninstall redirect URL.
• gmail_developer_numbered_alias store Developer email devextension546@gmail.com matches numbered-alias free-webmail pattern.
• stale_extension store Last updated March 2024; 29 months since update — exceeds 24-month zombie threshold.
• dom_xss_sink crx innerHTML assigned from variable KEEP_CHANGES in keepChanges.js without sanitization.
• yahoo_search_content_script manifest Content script injected on *://*.search.yahoo.com/*; can read/modify all Yahoo search pages.
• external_host_akamaihd crx js_external_hosts includes logstashpro-a.akamaihd.net — telemetry/logging CDN endpoint.
• tail_attack_surface api install_perm_anomaly.tail_attack_surface=true; 2000 installs with HIGH-tier permission (declarativeNetRequest).

Permissions Breakdown

• storage low Stores local extension data; low risk in isolation.
• declarativeNetRequestWithHostAccess high Can modify/block network requests; HIGH capability per rubric.
• alarms low Schedules periodic tasks; minimal risk.
• host_permissions: *://searchanything.co/* low Scoped to own domain only; narrow host access.
• content_scripts: *://*.search.yahoo.com/* medium Injects scripts into Yahoo Search pages; can read/modify search results.
• chrome_settings_overrides.search_provider (is_default:true) high Overrides default search engine to searchanything.co; significant monetization vector.

Pillar Scores

Bookkeeping