Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Call of Duty Ghost Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall URL hijack to haberikra.com — clear traffic-monetization pattern.
• Install URL hijack with UTM campaign params to haberikra.com — affiliate/ad-tech redirect on install.
• New-tab override combined with links to Amazon, Netflix, YouTube, Instagram, X — monetization shell.
• Privacy policy is Google's generic account policy — does not scope to this extension; scored as generic non-policy (D clause).

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → haberikra.com; Webstore +3.0 per rule.
• install_url_hijack crx onInstalled opens haberikra.com with UTM params; Webstore +2.0 per rule.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new-tab for all users.
• generic_privacy_policy store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy (clause D).
• js_external_hosts_monetization crx Extension contacts haberikra.com plus 6 major platforms; NewTab monetization shell pattern.
• no_developer_name store developer_name is empty; +1.0 Reputation.
• verified_publisher store Verified publisher badge present; -1.0 discount (capped by hijack/monetization signals per v3.5-E).
• maintenance_stale store 16 months since last update → +6.0 Maintenance pillar.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Call of Duty Ghost Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 6.22 -> 8.72 (+2.5 cap 2.5).

Permissions Breakdown

• chrome_url_overrides.newtab high Replaces every new-tab page; high user-facing surface for monetization and content injection.

Pillar Scores

Bookkeeping