Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — McLaren Artura Wallpapers New Tab [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy URL unreachable (fetch timeout) — effective no-policy state scores 10.0 on privacy pillar.
• Uninstall and install URL hijack to gameograf.com — confirmed monetization/tracking shell pattern.
• NewTab override with bit.ly affiliate shortlink in JS hosts — cloaked redirect/affiliate-link injection.
• Privacy policy hosted on unrelated domain (haberikra.com) with no extension-scoped data disclosure.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → gameograf.com with UTM tracking params confirmed.
• install_url_hijack manifest onInstalled opens gameograf.com with UTM params — standard monetization shell pattern.
• affiliate_hit_bitly crx bit.ly in js_external_hosts — generic short-link redirector flagged as affiliate/cloaking.
• privacy_policy_fetch_failed api Privacy policy at haberikra.com/privacy-policy/ returned ReadTimeout — treated as no policy.
• newtab_override manifest chrome_url_overrides.newtab = index.html — replaces every new tab page.
• privacy_policy_domain_mismatch store Dev domain gameograf.com; privacy policy on haberikra.com — unrelated domain, no scoping.
• stale_extension store 15 months since last update, 33 installs, 0 ratings — minimal accountability signal.
• verified_publisher store Verified publisher badge present (gameograf.com resolves) — partial trust discount applied.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — McLaren Artura Wallpapers New Tab [adware] + malext.io malicious_extension_sentry; score 5.56 -> 8.06 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying the browser search API; combined with newtab override, enables search monetization.
• chrome_url_overrides.newtab medium Replaces every new tab — high reach, primary monetization surface for wallpaper shells.

Pillar Scores

Bookkeeping