Top Risks

• NewTab override + search permission: classic search-monetization shell pattern.
• Uninstall and install URL hijack both present, redirecting to gameograf.com with UTM tracking.
• Privacy policy URL on unrelated domain (haberikra.com) failed to load — no data handling disclosure.
• bit.ly external JS host: affiliate/cloaking short-link redirector in JS external hosts.
• No developer name listed; privacy policy domain differs from developer domain.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces new tab entirely.
• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?utm_source=uninstall&utm_medium=link&utm_campaign=bg
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install&utm_medium=link&utm_campaign=bg
• affiliate_hit crx bit.ly in js_external_hosts — affiliate/cloaking redirector per threat_intel.
• privacy_policy_unfetchable store Privacy policy at haberikra.com/privacy-policy/ timed out; domain differs from developer domain.
• no_developer_name store developer_name is empty string; increases accountability gap.
• stale_extension store 15 months since last update; falls in 12-24mo maintenance band (+6.0).
• external_js_github_io crx mlionltd.github.io in js_external_hosts — external JS from GitHub Pages hosting.

Permissions Breakdown

• search medium Allows overriding search provider; combined with NewTab override is a monetization signal.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary vector for ad-monetization and search hijacking.

Pillar Scores

Bookkeeping