Top Risks

• Uninstall URL hijacks user to haberikra.com (third-party ad/news site) — confirmed monetization shell behavior.
• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and third-party sharing (v3.5-D: +10.0).
• NewTab override with install + uninstall URL hijacks: classic low-effort traffic-monetization pattern.
• JS contacts 9 external hosts including chatgpt.com, instagram.com, netflix.com, youtube.com, x.com — far beyond stated wallpaper function.
• Stale 20 months with no CSP and NewTab override; verified-publisher discount capped at -1.0 per invariant 0c (>18mo stale).

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → haberikra.com with UTM params; classic traffic-monetization uninstall hook.
• install_url_hijack manifest onInstalled opens gameograf.com with UTM params; monetization shell install redirect confirmed.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab with developer-controlled page.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension at all.
• privacy_policy_classification_d api fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true → v3.5-D: +10.0 privacy score.
• broad_external_js_hosts crx 9 external JS hosts: chatgpt.com, instagram.com, netflix.com, youtube.com, x.com — excessive for a wallpaper extension.
• stale_verified_publisher store 20 months since update; verified-publisher discount capped at -1.0 per invariant 0c (stale > 18mo).
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP declared.

Permissions Breakdown

• search medium Allows search provider override; paired with newtab override creates monetization surface.
• chrome_url_overrides.newtab medium Replaces new tab page; primary mechanism for this extension's ad-monetization shell pattern.

Pillar Scores

Bookkeeping