Top Risks

• Uninstall URL hijacks to haberikra.com — third-party traffic monetization pattern.
• NewTab override with search permission: classic search/ad-monetization shell, 21 months stale.
• Privacy policy is Google's generic policy — does not scope data collection to this extension (admits collection + 3rd-party sharing).
• Install URL opens third-party gameograf.com marketing page on install — onInstalled hijack.
• Extension contacts 9 external JS hosts (YouTube, Netflix, Instagram, X, ChatGPT, etc.) — excessive for a wallpaper.

Evidence

• uninstall_url_hijack crx setUninstallURL → haberikra.com with UTM params; classic monetization-shell fingerprint.
• install_url_hijack crx onInstalled opens gameograf.com marketing URL; traffic-monetization pattern.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab controlled by extension.
• stale_extension store Last updated Dec 2024; 21 months since update — maintenance risk.
• generic_privacy_policy store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• broad_js_external_hosts crx 9 external JS hosts including Netflix, Instagram, YouTube, X, ChatGPT — abnormal for wallpaper.
• no_csp manifest content_security_policy is null; MV3 has some defaults but no explicit CSP declared.
• verified_publisher_stale store Verified publisher but 21mo stale + generic policy; v3.5 caps discount to -1.0.

Permissions Breakdown

• search medium Allows overriding search provider; paired with newtab override this is a monetization surface.
• chrome_url_overrides.newtab medium Replaces every new tab; primary vector for search hijacking and ad injection.

Pillar Scores

Bookkeeping