Aston Villa

The bundled manifest is MV3 and declares 'search' and 'favicon' as required permissions, while the published CWS listing is MV2 with only 'topSites' as a required permission and 'chrome://favicon/' as optional. The 'search' permission — absent entirely from the published listing — enables overriding the browser's default search provider, giving brandTURBO control over all address-bar searches. This discrepancy means the permission bypassed CWS policy review for the published version.

{  "manifest_version": 3,  "permissions": [    "topSites",    "favicon",    "search"  ],  "optional_permissions": [    "history",    "bookmarks"  ],  "background": {    "service_worker": "background.js"  },  "externally_connectable": {    "matches": [      "*://*.avfc.co.uk/*"    ]  }}

Every user action — including search queries (type='search', val=<query text>) — is beaconed to m.instantsearch.net/stats, a domain operated by brandTURBO's searchturbo platform. Search terms are user-generated content not disclosed as a collected data category in the CWS privacy policy. While the destination is the publisher's own search infrastructure (not a fully independent third party), the collection of verbatim search queries without explicit privacy disclosure warrants flagging given the publisher's overall malicious track record.

var m, y = "https://europe-west1-api-searchturbo-com.cloudfunctions.net/invite-function/api",  v = "https://m.instantsearch.net/stats",  ...  var i = h(h({}, n), {}, {    t: e.type,    val: e.value,    rtag: t.rtag,    rsrc: "e",    jsv: u.Y3,    te: Math.floor((Date.now() - b) / 1e3)  });e.async ? function(e, t) {  navigator.sendBeacon ? n(navigator.sendBeacon(e, JSON.stringify(t))) : n(!1)}(v, i, e.status) : H(v, i, e.status);