Top Risks

• Uninstall URL hijack to haberikra.com with UTM tracking — confirmed monetization shell pattern.
• Install URL hijack to gameograf.com — installs open 3rd-party page immediately.
• Privacy policy is generic Google account policy (fetch failed / SSL error); not scoped to this extension at all.
• NewTab override + search permission with 9 external JS hosts including chatgpt.com, instagram.com, netflix.com — broad traffic funnel.
• 21 months since last update on a NewTab monetization extension — stale and unlikely to receive security patches.

Evidence

• uninstall_url_hijack crx setUninstallURL -> haberikra.com with utm_source=gameograf; confirmed 3rd-party redirect for monetization.
• install_url_hijack crx onInstalled opens gameograf.com with UTM params; traffic monetization on install.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab is controlled by this extension.
• privacy_policy_unfetchable store Policy URL points to Google account privacy page; fetch failed SSL error; not scoped to extension.
• external_js_hosts crx 9 external hosts: chatgpt.com, gameograf.com, haberikra.com, play.gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com.
• stale_newtab_extension store 21 months since update; NewTab monetization extension with no maintenance is an elevated supply-chain risk.
• no_developer_name store Developer name field is empty; reduces accountability despite verified_publisher flag.
• verified_publisher_cap_applied api v3.5 invariant 0c: verified-publisher discount capped at -1.0 due to months_since_update=21 > 18.

Permissions Breakdown

• search medium Allows overriding search provider; paired with newtab override is a monetization-shape.
• chrome_url_overrides.newtab medium Replaces new-tab page; enables ad-monetization and traffic capture on every new tab.

Pillar Scores

Bookkeeping