Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Manchester United FC Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall and install URL hijacks both redirect to haberikra.com tracking URLs — classic monetization shell pattern.
• NewTab override + search permission enables search-query capture and ad-revenue injection on every new tab.
• Privacy policy URL timed out (fetch_error); effective privacy disclosure is zero — scored as no policy.
• bit.ly affiliate/cloaking redirector in js_external_hosts; destination unknown and unverifiable.

Evidence

• install+uninstall URL hijack manifest onInstalled and uninstall both redirect to haberikra.com with UTM tracking params — confirmed monetization shell.
• NewTab override manifest chrome_url_overrides.newtab = index.html; captures every new-tab page for ad/search monetization.
• privacy policy fetch failed crx privacy_policy_classification.fetched==false (ReadTimeout); treated as no policy → +10.0 privacy pillar.
• affiliate hit: bit.ly crx bit.ly in js_external_hosts flagged as affiliate/cloaking redirector; destination unverifiable.
• mlionltd.github.io external host crx Unknown GitHub Pages domain in js_external_hosts; no ownership linkage to haberikra.com established.
• stale extension (16mo) + NewTab + search override store v3.5(C): 1 search engine seen, not multi-engine anomaly, but stale+NewTab+search is high-risk cluster.
• verified publisher (stale >18mo cap applied) store Invariant 0c: months_since_update=16 (<18), monetization_hits empty, affiliate_hits=1 — cap does NOT fully trigger; standard -3.0 applies.
• rating=1, install_count=328 store Low installs and lowest possible rating indicate poor user experience or functional issues.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Manchester United FC Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.76 -> 8.26 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Grants ability to read/control search queries; paired with NewTab override creates search monetization surface.
• chrome_url_overrides.newtab medium Replaces every new tab; captures all new-tab navigation, strong monetization/tracking surface.

Pillar Scores

Bookkeeping