Top Risks

• Uninstall URL hijack to haberikra.com — confirms monetization-shell pattern for a wallpaper extension.
• Install URL hijack to haberikra.com — tracks and monetizes installs via third-party redirect.
• Privacy policy is Google's own account policy — does not scope to this extension at all; scores +10.
• New-tab override + search permission with 9 external JS hosts including Instagram, Netflix, YouTube — broad tracking surface.
• 15 months since last update on a low-install newtab/monetization shell raises abandonment and supply-chain risk.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL -> haberikra.com with UTM params; monetization shell fingerprint.
• install_url_hijack crx onInstalled opens haberikra.com with UTM params; confirms install-tracking monetization.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; every new tab controlled by this extension.
• privacy_policy_generic_google store Policy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true.
• external_js_hosts_broad crx 9 external hosts: haberikra.com, chatgpt.com, instagram.com, netflix.com, youtube.com, x.com, google.com, chrome.google.com, play.gameograf.com.
• developer_name_missing store developer_name is empty string; verified_publisher true but no displayed name.
• months_since_update_15 store Last updated May 2025; 15 months stale — falls in 12-24mo band (+6.0 maintenance).
• no_csp manifest content_security_policy is null; MV3 default CSP applies but no explicit override provided.

Permissions Breakdown

• search medium Allows access to search queries; combined with newtab override enables search monetization.
• chrome_url_overrides.newtab medium Replaces every new tab; primary surface for ad/monetization injection and traffic capture.

Pillar Scores

Bookkeeping