Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — The Legend of Zelda 4K Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall and install URL hijack both route to haberikra.com — confirmed monetization shell pattern.
• Privacy policy is Google's own policy (scope_extension=false, data_collection+3rd-party=true) — worst-case privacy disclosure.
• New-tab override with search permission and 9 external JS hosts including haberikra.com signals ad-monetization aggregator.
• Extension contacts 9 diverse external hosts (Netflix, YouTube, Instagram, ChatGPT, X, etc.) from a wallpaper/newtab shell.

Evidence

• install+uninstall URL hijack manifest Both onInstalled and uninstall fire to haberikra.com with UTM tracking params — classic monetization shell.
• newtab override manifest chrome_url_overrides.newtab='newtab.html'; replaces every new tab with developer-controlled page.
• privacy policy is Google account policy store URL myaccount.google.com/privacypolicy — not scoped to this extension; fetched policy admits data collection+3rd-party sharing.
• 9 external JS hosts crx haberikra.com, chatgpt.com, instagram.com, netflix.com, youtube.com, x.com, play.gameograf.com, google.com, chrome.google.com.
• webstore — install/uninstall hijack pattern store +3.0 uninstall hijack +2.0 install hijack scored under webstore signals per rubric.
• maintenance: 16 months since update api 16mo qualifies for +6.0 maintenance band (12-24mo stale).
• new-tab monetization shape manifest +2.0 new-tab override with monetization shape applied (haberikra.com UTM tracking).
• no CSP present manifest content_security_policy=null on MV3; no additional network pillar penalty per MV3 rule but noted for jquery combo check.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — The Legend of Zelda 4K Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.49 -> 7.99 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/modifying search queries; paired with newtab override amplifies search-monetization risk.
• chrome_url_overrides.newtab medium Replaces every new tab page; primary surface for ad-monetization and search redirect in this category.

Pillar Scores

Bookkeeping