Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Winter Christmas House Aurora 4K Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall and install URL hijack redirecting users to third-party site haberikra.com
• Generic Google privacy policy used instead of an extension-specific policy
• Privacy policy admits data collection and third-party sharing without extension scope
• NewTab extension pattern commonly associated with traffic monetization

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL() targets 3rd party haberikra.com
• install_url_hijack manifest onInstalled opens 3rd-party URL haberikra.com
• newtab_override manifest chrome_url_overrides.newtab set to newtab.html
• generic_privacy_policy api Privacy policy is generic Google My Account policy, not extension-scoped
• privacy_admits_sharing api Policy classifies data_collection=true, third_party_sharing=true, scope=false
• low_installs_monetization_shape store 235 installs with install/uninstall hijack to ad-tech domain
• no_csp_mv3 manifest content_security_policy is null despite MV3
• operator_cluster api Sibling count 1, dev email shared across 31 other extensions
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Winter Christmas House Aurora 4K Wallpaper [adware] + malext.io malicious_extension_sentry; score 7.28 -> 9.78 (+2.5 cap 2.5).

Permissions Breakdown

• search low Controls default search engine settings; low risk alone.
• chrome_url_overrides.newtab medium Overrides the new tab page, providing control over user browsing surface.

Pillar Scores

Operator Siblings (1)

Other extensions sharing this developer's compound fingerprint:

• aonhacgjmogphocecdbhkbmgbcpfdmlb

Bookkeeping