Top Risks

• NewTab override with uninstall/install URL hijack to haberikra.com — classic monetization shell pattern.
• Privacy policy is Google's own policy, not scoped to this extension; admits data collection & 3rd-party sharing.
• No developer name listed; verified publisher status alone is insufficient given monetization signals.
• install_url_hijack and uninstall_url_hijack both fire tracking URLs to haberikra.com/gameograf.
• DOM-XSS sink (innerHTML) in popup.js with no CSP present elevates code quality risk.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html; extension replaces every new tab.
• install_url_hijack crx onInstalled opens https://haberikra.com/?utm_source=install&utm_medium=link&utm_campaign=bg&utm_content=install
• uninstall_url_hijack crx setUninstallURL fires https://haberikra.com/?utm_source=gameograf&utm_medium=link&utm_campaign=bg&utm_content=uninstall
• privacy_policy_generic store Policy URL is Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• no_developer_name store developer_name field is empty string; identity unverifiable beyond email.
• dom_xss_sink_no_csp crx innerHTML user-controlled in popup.js; csp_present=false amplifies XSS risk.
• maintenance_stale store 16 months since last update; stale for >12mo raises supply-chain and abandonment risk.
• verified_publisher_capped api Verified publisher discount capped at -1.0 per invariant 0c: months_since_update=16 > 18 threshold not met, but monetization URL pattern applies.

Permissions Breakdown

• search medium Allows overriding search provider; monetization vector when combined with NewTab override.
• host_permissions: https://api.gameograf.com/* medium Scoped host permission to developer-controlled API; enables data exfil or command-and-control.
• chrome_url_overrides.newtab medium NewTab override is a primary monetization/redirect surface; high reach on every new tab.

Pillar Scores

Bookkeeping