Top Risks

• Default search engine overridden to dev-controlled search-rewards.com; all user queries routed there.
• Content scripts injected into Yahoo and Bing search pages; can observe/modify search results.
• Privacy policy URL unreachable (ConnectTimeout); effective privacy disclosure is zero.
• Extension last updated 28 months ago; stale codebase with no recent maintenance.
• Developer identity unverified: gmail address, no developer name, domain non-resolving for policy.

Evidence

• search_provider_override manifest chrome_settings_overrides sets is_default=true, routing all searches to search-rewards.com.
• content_scripts_on_competitor_search manifest Scripts injected into yahoo.com and bing.com search result pages.
• privacy_policy_unreachable api Fetch of https://search-rewards.com/privacy-policy returned ConnectTimeout; treated as no policy.
• stale_extension store Last updated May 2024; 28 months since update — deep into high-stale band.
• free_webmail_dev_no_name store Developer email starlion440@gmail.com; developer_name empty; no verified business identity.
• install_url_hijack crx install_url_hijack=true; onInstalled opens a third-party URL.
• dom_innerHTML_no_csp crx 14 files contain innerHTML DOM-XSS sinks; csp_present=false amplifies risk to +2.0.
• verified_publisher_stale_cap store Verified+featured discounts capped at -1.0 (v3.5 invariant 0c): months_since_update=28 >18.

Permissions Breakdown

• storage low Local data persistence only; low standalone risk.
• alarms low Scheduled tasks; minimal risk.
• host_permission: https://clickreward.net/* medium Scoped host access to affiliate/reward network domain.
• host_permission: https://search-rewards.com/* medium Scoped host access to dev domain; overlaps search override.
• chrome_settings_overrides.search_provider (is_default: true) high Forces default search engine to dev-controlled domain; monetization risk.
• content_scripts: https://*.search.yahoo.com/yhs/search*, https://search.yahoo.com/yhs/search*, https://www.bing.com/search* high Injects scripts into Yahoo and Bing search results pages; can intercept queries.

Pillar Scores

Bookkeeping