Top Risks

• Uninstall URL hijack redirects to gameograf.com — clear monetization/traffic capture on removal.
• Install URL hijack opens gameograf.com on install — unsolicited redirect to third-party site.
• Privacy policy URL timed out (fetch error) — no verifiable data handling disclosure.
• NewTab override + search permission = classic search-monetization shell pattern.
• 9 external JS hosts including chatgpt.com, Netflix, Instagram — broad outbound surface for a background-image extension.

Evidence

• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?utm_source=gameograf&utm_medium=link&utm_campaign=bg&utm_content=uninstall
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install&utm_medium=link&utm_campaign=bg&utm_content=install
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; combined with search permission indicates monetization shell.
• privacy_policy_fetch_failed api fetch_error:ReadTimeout on https://haberikra.com/privacy-policy/ — policy unverifiable, scored as +10.0.
• external_js_hosts crx 9 external hosts: gameograf.com, chatgpt.com, netflix.com, instagram.com, youtube.com, reddit.com, x.com, google.com, chrome.google.com.
• no_developer_name store developer_name is empty; verified_publisher is true but no display name raises accountability gap.
• stale_extension store 15 months since last update — falls in 12-24mo band (+6.0 maintenance).
• verified_publisher store Verified publisher badge present; discount capped at -1.0 due to months_since_update > 18 (v3.5 invariant 0c).

Permissions Breakdown

• search medium Allows search provider manipulation; combined with newtab override raises monetization risk.
• chrome_url_overrides.newtab medium Replaces new tab page — primary vector for ad monetization and search hijacking.

Pillar Scores

Bookkeeping