Top Risks

• Uninstall URL hijack redirects to gameograf.com with UTM tracking — confirmed monetization shell pattern.
• Install URL hijack opens haberikra.com on install — aggressive post-install affiliate/ad redirect.
• Privacy policy is Google's own policy (myaccount.google.com) — not scoped to this extension; admits data collection and 3rd-party sharing → +10 privacy.
• NewTab override with search permission and 10 JS external hosts (YouTube, Netflix, Instagram, ChatGPT, X) exposes broad tracking surface.
• Stale 21 months; no CSP; NewTab monetization pattern with unscoped policy warrants blocking.

Evidence

• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?utm_source=haberikra&utm_medium=link&utm_campaign=bg — 3rd-party redirect.
• install_url_hijack crx onInstalled opens https://haberikra.com/?utm_source=extension&utm_medium=link&utm_campaign=bg — affiliate/ad redirect.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; search permission also declared — NewTab monetization cluster.
• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true → Privacy +10.
• js_external_hosts crx 10 external hosts including haberikra.com, gameograf.com, netflix.com, instagram.com, chatgpt.com, x.com.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP declared.
• maintenance_stale store Last updated December 31, 2024; months_since_update=21 → Maintenance +6.0.
• install_url_and_uninstall_url_hijack_combo crx Both install and uninstall URL hijacks present → Webstore +2.0+3.0 monetization/shell pattern signals.

Permissions Breakdown

• search medium Allows reading search queries; paired with NewTab override creates search-monetization surface.
• chrome_url_overrides.newtab medium Replaces every new tab — primary monetization vector for this extension type.

Pillar Scores

Bookkeeping