Top Risks

• Uninstall URL hijack to haberikra.com — classic monetization shell pattern (+3.0 Webstore).
• Install URL hijack opens gameograf.com on install (+2.0 Webstore).
• Privacy policy is Google's own policy — not scoped to this extension; admits collection+sharing → +10.0 Privacy.
• NewTab override with search permission; 9 external JS hosts including social/streaming platforms is anomalous.
• Extension stale 21 months with newtab override and no CSP — elevated residual risk.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL targets haberikra.com with utm params — monetization shell signal.
• install_url_hijack crx onInstalled opens gameograf.com with utm tracking params.
• privacy_policy_generic store Policy URL is Google's account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces new-tab with wallpaper shell.
• js_external_hosts_anomalous crx 9 external hosts including chatgpt.com, instagram.com, netflix.com, x.com — far beyond wallpaper function.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit restriction.
• stale_21mo store Last updated Dec 2024; 21 months since update — 6–24 month band.
• verified_publisher_but_stale_monetization store Verified publisher cap applies: stale >18mo AND monetization via uninstall/install hijack → discount capped at -1.0.

Permissions Breakdown

• search medium Allows search provider interaction; combined with newtab override is a monetization vector.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary surface for ad/monetization injection.

Pillar Scores

Bookkeeping