Top Green Search

AI Security Review

Evidence context: threat category browser hijack; evidence quality moderate.

This extension exhibits clear browser hijacking behavior. The description explicitly states it will "Make Top Green Search your default search in browser omnibox," and the IoC findings confirm this: topgreenview.com/search?q= is the search query endpoint, topgreenview.com/start?session=$ tracks new sessions, and topgreenview.com/uninstall?session=$ tracks when users remove the extension. These session tracking URLs are a hallmark of browser hijackers that monetize search traffic.

The developer attribution is [email protected] — an anonymous Gmail address with no company name or verifiable identity. Combined with the extension's behavior of redirecting searches to an unknown domain (topgreenview.com) rather than a legitimate search provider, this matches the browser hijacking threat pattern.

The network finding in bg.js:8 shows fetch calls, which is expected for a search redirect extension but confirms the extension actively communicates with its backend. The clients2.google.com IoCs are legitimate Chrome update service endpoints and represent no risk.

Several IoC findings are false positives: rules.map and rule.id are property access chains misread as domains by the XIOC extractor, and www.inkscape.org is a legitimate open-source software website that appears to be incidental (possibly from bundled code or documentation).

The YARA finding postinstall_crypto_operations is a code-smell rule that matches basic JavaScript crypto patterns and is documented as noise in the CVEQ threat model. It does not indicate actual malware.

Counterargument consideration: A skeptic might argue this is a legitimate search extension since it has 10,000 users and performs a declared function (changing search provider). However, the combination of anonymous publishing, session tracking URLs, and redirection to an unknown search domain without any legitimate company backing places this firmly in the browser hijacker category. Legitimate search extensions from known companies (Google, Bing, DuckDuckGo) do not use anonymous email addresses or session tracking on uninstall.

This extension should be classified as a confirmed risk due to its browser hijacking behavior, even though it does not contain actual malware signatures.

Key Reasons

• Search redirection to unknown domain topgreenview.com
• Session tracking URLs (start?session=, uninstall?session=)
• Anonymous developer with no company attribution
• Extension explicitly changes default search engine
• No malware signatures detected

False Positive Considerations

• postinstall_crypto_operations code-smell rule
• Property access chains misread as domains (rules.map, rule.id)
• Legitimate Google update service domains
• Incidental legitimate domain (www.inkscape.org)

Reviewed 2026-05-23; recommended action: monitor; model confidence 82%.