Top Risks

• NewTab override + search override = aggressive monetization shell disguised as wallpaper.
• Uninstall and install URL hijacks redirect to haberikra.com tracking URLs.
• Privacy policy is Google's own policy — not scoped to this extension; data_collection+third_party_sharing admitted without extension context.
• No developer name listed; verified publisher status does not excuse missing identity.
• 16-month stale update caps verified-publisher discount per invariant 0c.

Evidence

• newtab_override_plus_search manifest chrome_url_overrides.newtab set; permissions include 'search' — classic monetization NewTab combo.
• install_uninstall_hijack crx install_url_target and uninstall_url_target both route to haberikra.com with UTM tracking params.
• generic_google_privacy_policy store Privacy policy URL is myaccount.google.com/privacypolicy — not scoped to this extension at all.
• privacy_policy_classification_admits_data api scope_extension=false, data_collection=true, third_party_sharing=true → D clause: +10.0 privacy pillar.
• verified_publisher_stale_cap store verified_publisher=true but months_since_update=16 >18mo threshold not met; cap at -1.0 per 0c still noted.
• no_developer_name store developer_name is empty string — no 'Offered by' identity; +1.0 reputation penalty.
• dom_xss_sink_no_csp crx innerHTML user-controlled in popup.js; csp_present=false triggers elevated code-quality scoring.
• js_external_hosts crx 5 external hosts: api.gameograf.com, gameograf.com, haberikra.com, chrome.google.com, www.google.com.

Permissions Breakdown

• search medium Allows overriding search provider — monetization vector paired with newtab override.
• host_permissions: https://api.gameograf.com/* medium Scoped host access to developer's own game/wallpaper API backend.
• chrome_url_overrides.newtab medium Replaces new-tab page — high-reach monetization surface, scored per v2 calibration rule (a).

Pillar Scores

Bookkeeping