Top Risks

• Uninstall URL hijacks to haberikra.com (third-party ad/news site) confirming monetization shell pattern.
• New-tab override combined with 'search' permission enables search and revenue hijacking.
• Privacy policy is Google's generic account policy — not scoped to this extension, admits collection and third-party sharing.
• Extension contacts 9 external JS hosts (chatgpt.com, instagram.com, netflix.com, x.com, youtube.com) with no declared host_permissions — suspicious scope for a wallpaper.
• 21 months since last update with no CSP; stale, unaudited codebase with broad external host list.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL points to haberikra.com with UTM params — classic monetization shell fingerprint (+3.0 Webstore).
• install_url_hijack crx onInstalled opens gameograf.com with UTM install params (+2.0 Webstore).
• newtab_override manifest chrome_url_overrides.newtab=index.html replaces every new tab; scored as HIGH permission (+2.0 Permissions, +2.0 Webstore newtab override).
• privacy_policy_generic store Policy URL is Google account policy: scope_extension=false, data_collection=true, third_party_sharing=true → Privacy pillar +10.0 per v3.5 rule D.
• js_external_hosts_broad crx 9 external hosts including chatgpt.com, instagram.com, netflix.com, x.com, youtube.com — far beyond stated wallpaper function.
• no_csp manifest content_security_policy is null; MV3 has strict default but absence noted alongside external host breadth.
• stale_extension store 21 months since last update → Maintenance +6.0 (12-24mo band).
• developer_name_missing store developer_name is empty string; no 'Offered by' display name → Reputation +1.0.

Permissions Breakdown

• search medium Allows search provider manipulation; paired with NewTab override amplifies monetization risk.
• chrome_url_overrides.newtab high Replaces new-tab page; core vector for ad-monetization and search hijacking in wallpaper shells.

Pillar Scores

Bookkeeping