Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Cats and Kittens HD Wallpaper New Tab [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• New-tab override with uninstall/install URL hijacks to haberikra.com — classic monetization shell pattern.
• Privacy policy URL timed out (fetch_error:ReadTimeout) — treated as no policy; data handling unknown.
• bit.ly in js_external_hosts flagged as affiliate/cloaking redirector.
• No developer name listed and no CSP despite external JS hosts including mlionltd.github.io.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new-tab page for all users.
• uninstall_url_hijack crx setUninstallURL -> https://haberikra.com/?utm_source=uninstall&utm_medium=link&utm_campaign=bg
• install_url_hijack crx onInstalled opens https://haberikra.com/?utm_source=install&utm_medium=link&utm_campaign=bg
• affiliate_hit crx bit.ly in js_external_hosts — generic short-link redirector used for affiliate/cloaking.
• privacy_policy_fetch_failed api privacy_policy_classification.fetched=false; reason=fetch_error:ReadTimeout. Scored as no policy.
• no_csp manifest content_security_policy is null; MV3 default applies but external hosts include github.io CDN.
• no_developer_name store developer_name is empty string; no 'Offered by' attribution despite verified_publisher=true.
• stale_newtab store 17 months since update; newtab monetization shell with unreachable privacy policy = ongoing risk.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Cats and Kittens HD Wallpaper New Tab [adware] + malext.io malicious_extension_sentry; score 4.18 -> 6.68 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows search-provider manipulation; paired with newtab override amplifies monetization risk.
• chrome_url_overrides.newtab high Replaces new-tab page — primary mechanism for ad-monetization shells.

Pillar Scores

Bookkeeping