Maps Driving Directions

AI Security Review

Evidence context: threat category browser hijack; evidence quality moderate.

The Maps Driving Directions extension exhibits classic browser hijacking behavior. The extension description states it enables users to "search for relevant information about a location through your browser's search box," which indicates search functionality manipulation. The IoC findings confirm this: XIOC-URL-https://g-maps.com/mapsdriving.php?q= shows the extension routes search queries to a third-party domain (g-maps.com) rather than legitimate search services. This is the defining characteristic of browser hijackers.

The developer attribution is anonymous: [email protected] is an email address with no company name or verified publisher identity. This is a red flag for extensions that manipulate browser behavior. The domain locstorage.data in the IoC findings (XIOC-DOMAIN-locstorage.data) suggests potential tracking or data collection infrastructure separate from the main service.

Several IoC findings are false positives that should be discounted: http://ns.adobe.com/xap/1.0/mm/ and http://www.w3.org/1999/02/22-rdf-syntax-ns# are standard metadata namespaces from embedded images, not network destinations. The IP 2.7.7.8 is the extension version number misidentified by the IoC extractor. The domain clients2.google.com is a legitimate Google infrastructure domain. These account for approximately 4 of the 33 IoC findings.

The code-smell findings (9 total, severity=low) are expected noise from standard JavaScript patterns and do not indicate malicious behavior. No malware signatures, obfuscation, or credential-theft indicators were detected.

Counterargument: A skeptic might argue this is a legitimate maps helper extension since there are no malware signatures and the g-maps.com domain could be a legitimate service. However, the combination of search box manipulation, anonymous developer, and third-party search redirect domain constitutes confirmed browser hijacking behavior regardless of malware signatures. The extension's purpose is to intercept and redirect user search traffic, which is the definition of a PUP/browser hijacker. Users installing this extension will have their search queries sent to g-maps.com instead of their configured search engine, potentially exposing search history to a third party with no accountability.

Recommendation: This extension should be flagged as a browser hijacker. Users should be warned that search functionality will be redirected to an unverified third-party service.

Key Reasons

• Search redirection to third-party g-maps.com domain confirmed via IoC findings
• Anonymous developer attribution (email only, no company)
• Browser hijacking behavior pattern (search box manipulation)
• Suspicious tracking domain locstorage.data detected
• No malware signatures but clear PUP behavior

False Positive Considerations

• Adobe namespace URLs from embedded image metadata
• W3C RDF namespace URLs from metadata
• Version number misidentified as IP address (2.7.7.8)
• Google infrastructure domain clients2.google.com

Reviewed 2026-04-28; recommended action: escalate; model confidence 82%.