Top Risks

• Uninstall URL hijacks to haberikra.com (3rd-party ad/news site) and install URL opens gameograf.com — classic monetization shell.
• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• NewTab override + search permission with 9 external JS hosts including Instagram, Netflix, YouTube, X — excessive reach for a theme.
• 21 months since last update (>18mo) — verified-publisher discount capped at -1.0 per invariant 0c/3.5E.
• No developer name disclosed; missing CSP; extension description uses i18n placeholders — minimal transparency.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → haberikra.com with UTM params; clear monetization redirect on uninstall.
• install_url_hijack crx onInstalled opens gameograf.com with UTM params; unsolicited 3rd-party page open on install.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension.
• privacy_policy_classification api fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (D rule).
• newtab_override manifest chrome_url_overrides.newtab set to index.html; new-tab monetization shell pattern.
• js_external_hosts crx 9 external hosts: chatgpt.com, Instagram, Netflix, YouTube, X, haberikra.com — far beyond theme function.
• stale_extension store 21 months since update; verified-publisher discount capped at -1.0 per 0c/3.5E (>18mo stale).
• no_developer_name store developer_name is empty string; reduces accountability.

Permissions Breakdown

• search medium Allows overriding search provider behavior; paired with newtab override amplifies risk.
• chrome_url_overrides.newtab medium Replaces new-tab page; classic monetization shell pattern with uninstall/install URL hijack.

Pillar Scores

Bookkeeping