Top Risks

• Default search provider override routes all browser searches through s.fusebase-search.com — opaque operator.
• Developer domain nimbusweb.co does not resolve; no accountability anchor.
• Privacy policy is 185 chars, not scoped to this extension, no data collection or retention detail.
• No developer name listed; reduced accountability.
• Extension brand (Fusebase) differs from developer domain (nimbusweb.co) with no confirmed ownership link.

Evidence

• search_provider_override manifest chrome_settings_overrides sets Fusebase Search as default; all queries go to s.fusebase-search.com.
• developer_domain_not_resolving api threat_intel: nimbusweb.co resolves=false; no live developer domain to verify identity.
• privacy_policy_stub api Policy fetched but only 185 chars; scope_extension=false, data_collection=false, retention=false.
• no_developer_name store developer_name is empty string; reduced publisher accountability.
• unverified_publisher store verified_publisher=false, is_featured_by_google=false.
• low_installs store Only 459 installs; tail-attack-surface flag is false but minimal community vetting.
• no_code_surface crx js_file_count=0, code_findings_raw empty, obfuscation_score=0; extension is pure manifest override.
• third_party_silence api privacy_policy_classification.third_party_silence=true; policy does not address third-party sharing.

Permissions Breakdown

• host_permissions: *://*.s.fusebase-search.com/* low Scoped to extension's own search subdomain; narrow functional scope.
• host_permissions: https://chrome.google.com/* low Access to Chrome Web Store domain; low-impact for search provider use.
• chrome_settings_overrides: search_provider (is_default=true) medium Overrides default search engine; routes all search queries through s.fusebase-search.com.

Pillar Scores

Bookkeeping