Top Risks

• NewTab override + uninstall URL hijack to haberikra.com signals monetization shell pattern.
• Privacy policy is Google's generic policy — does not scope data handling to this extension at all.
• Install URL hijack opens gameograf.com on install; classic traffic-monetization behavior.
• 9 external JS hosts (Netflix, YouTube, Instagram, X, ChatGPT, etc.) far exceeds wallpaper function.
• No developer name listed; 21-month-stale extension with newtab override and no CSP.

Evidence

• uninstall_url_hijack crx Uninstall redirects to haberikra.com with UTM params — 3rd-party domain, monetization fingerprint.
• install_url_hijack crx onInstalled opens gameograf.com with UTM params — traffic hijack on every install.
• newtab_override manifest chrome_url_overrides.newtab set to index.html — replaces every new tab for all users.
• generic_privacy_policy store Policy URL is Google's own privacy page (479 KB); scope_extension=false, admits data collection & 3rd-party sharing.
• excessive_external_hosts crx JS contacts 9 domains incl. Netflix, YouTube, Instagram, X, ChatGPT — far beyond wallpaper scope.
• no_csp manifest content_security_policy is null; MV3 default applies but absence noted with external host breadth.
• stale_extension store 21 months since last update; newtab override extension with no active maintenance.
• verified_publisher_cap store Verified publisher but months_since_update=21 >18mo triggers 0c cap; discount capped at -1.0.

Permissions Breakdown

• search medium Allows modification of search behavior; paired with newtab override amplifies monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab; primary vector for ad/monetization shells and traffic hijack.

Pillar Scores

Bookkeeping