Top Risks

• New-tab override with uninstall URL hijack redirecting to haberikra.com ad-tech domain — monetization shell pattern.
• Install URL hijack opens gameograf.com on install — confirmed install-hijack pattern.
• Privacy policy is Google's generic policy; not scoped to this extension, admits data collection and 3rd-party sharing.
• 9 distinct external JS hosts (Netflix, Instagram, YouTube, X, ChatGPT, etc.) with no CSP — broad outbound surface.
• Stale 15 months, no developer name, no ratings — low accountability for extension overriding every new tab.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → haberikra.com with UTM params; confirmed 3rd-party ad/monetization redirect.
• install_url_hijack crx onInstalled opens gameograf.com with UTM install tracking params.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab served by extension.
• privacy_policy_generic store Policy URL is Google account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• js_external_hosts_broad crx 9 external hosts: chatgpt.com, netflix.com, instagram.com, youtube.com, x.com, haberikra.com + dev domains.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP with 9 external hosts.
• stale_no_developer_name store 15 months since update, developer_name empty, 0 ratings — low governance signal.
• verified_publisher_cap_applied store Verified publisher but months_since_update=15 >12; 0c cap limits discount to -1.0 on reputation.

Permissions Breakdown

• search medium Allows querying/manipulating browser search; medium risk in isolation.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; high monetization/redirect risk.

Pillar Scores

Bookkeeping