Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — The Intriguing Shinobu Kocho Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall URL hijacks user to haberikra.com ad-tech/news portal — classic monetization shell.
• Install URL redirect to gameograf.com on first run; new-tab override captures all new-tab traffic.
• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• 21-month stale update with newtab override and broad external JS hosts (netflix, youtube, instagram, x.com, chatgpt.com).

Evidence

• uninstall_url_hijack crx setUninstallURL → haberikra.com with UTM params; textbook monetization redirect.
• install_url_hijack crx onInstalled opens gameograf.com with UTM campaign; unsolicited navigation on install.
• newtab_override manifest chrome_url_overrides.newtab = index.html; captures every new-tab page.
• privacy_policy_generic_google store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not extension-specific.
• privacy_policy_classification api scope_extension=false, data_collection=true, third_party_sharing=true → v3.5(D) → +10.0 privacy.
• js_external_hosts_broad crx 9 external JS hosts incl. netflix.com, instagram.com, x.com, chatgpt.com, haberikra.com.
• months_since_update_21 store Last updated Dec 2024; 21 months stale → Maintenance +6.0.
• no_developer_name store developer_name is empty string; reduces accountability despite verified_publisher=true.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — The Intriguing Shinobu Kocho Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 6.34 -> 8.84 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows search-provider manipulation; combined with newtab override elevates risk.
• chrome_url_overrides.newtab high Replaces new-tab page; prime surface for ad-monetization and traffic hijack.

Pillar Scores

Bookkeeping