Top Risks

• Uninstall and install URL hijack redirect to haberikra.com — explicit monetization/traffic harvesting.
• Privacy policy is Google's own policy, not scoped to this extension; data practices completely undisclosed.
• New-tab override + search permission is classic ad-monetization shell pattern.
• Extension contacts 9 external JS hosts including haberikra.com with no declared host permissions.
• Stale 16 months with no reviews, 185 installs — low accountability, high option value for future abuse.

Evidence

• install_url_hijack crx onInstalled opens https://haberikra.com/?utm_source=install&utm_medium=link&utm_campaign=bg — 3rd-party traffic redirect.
• uninstall_url_hijack crx setUninstallURL points to https://haberikra.com/?utm_source=uninstall — monetization on exit.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html replaces every new tab with extension-controlled page.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• js_external_hosts crx 9 external hosts referenced including haberikra.com, chatgpt.com, instagram.com, netflix.com, youtube.com.
• no_csp manifest csp_present=false on MV3 extension with newtab override and 9 external JS host references.
• stale_extension store Last updated May 2025; 16 months since update with only 185 installs and zero ratings.
• search_permission_newtab_combo manifest search permission + newtab override = textbook ad-monetization shell; no stated productivity function.

Permissions Breakdown

• search medium Allows search provider manipulation; paired with newtab override indicates monetization intent.
• chrome_url_overrides.newtab medium Replaces new tab page; primary surface for ad/affiliate monetization.

Pillar Scores

Bookkeeping