Top Risks

• Privacy policy URL is on a different domain (haberikra.com) and could not be fetched — treated as no policy.
• Uninstall and install URL hijacks redirect to gameograf.com with UTM tracking (+3.0+2.0 webstore).
• NewTab override combined with 'search' permission creates ad/affiliate monetization surface.
• bit.ly in js_external_hosts flagged as affiliate/cloaking redirector by threat intel.
• Stale 16 months with no CSP and privacy policy inaccessible on a different domain.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL points to gameograf.com with UTM params — monetization shell pattern.
• install_url_hijack crx onInstalled opens gameograf.com with UTM params — install redirect to 3rd-party URL.
• privacy_policy_unfetchable api Policy URL haberikra.com/privacy-policy/ returned HTTP error; different domain from developer; treated as no policy.
• affiliate_hit crx bit.ly in js_external_hosts flagged as affiliate/cloaking redirector by threat_intel.
• newtab_override manifest chrome_url_overrides.newtab = index.html replaces every new-tab page for all users.
• no_csp manifest content_security_policy is null; MV3 has strict default but no explicit CSP declared.
• no_developer_name store developer_name is empty string; reduces accountability.
• stale_16mo store Last updated May 2025 but months_since_update=16 — maintenance risk bracket 12-24mo.

Permissions Breakdown

• search medium Allows querying and potentially influencing search; paired with newtab override raises monetization concern.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary surface for ad/affiliate monetization in this category.

Pillar Scores

Bookkeeping