The extension's only functional behaviour is:28-37, which silently makes [domain withheld]} the default search engine (is_default: true) under the generic provider name "Online"; it ships no maps or directions code at all, so the override IS the product. That destination is a third party relative to the publisher's own domain ([domain withheld], the website and privacy policy URL) and relative to [domain withheld] (the and listing-linked policy pages), and the listing explicitly tells users searches go to "Yahoo" — the mismatch plus "none declared" data collection while every typed query is routed to an undisclosed third party is what makes this deceptive monetised search hijacking rather than sloppiness. Contradicting signals: there is no, no remote code loading, no obfuscation and no covert exfiltration in any of the three JS files, the only permission is storage, and the risk engine (Low) and chrome-stats (impact) are near-clean — chrome-stats does independently flag permission-override-search-provider on the live version. I am deliberately not leaning on the "publisher malicious" figure or the internal note, since both trace to the same 2026-09-13 malext feed import and are one source, not independent corroboration. Non-findings worth recording: is never injected (no content_scripts key, no scripting permission),:158-175 calls which are undefined without those permissions, SET_USER_STATUS uses localStorage which does not exist in an MV3 service worker, and.js addContextMenu are residue from a new-tab-page template; onMessageExternal registered with no externally_connectable is hygiene, not an exploitable channel. The random cid UUID posted to the listing-disclosed [domain withheld] pages is ordinary install attribution.