Top Risks

• Uninstall URL hijacks to gameograf.com with UTM tracking; install URL hijacks to haberikra.com — dual redirect monetization shell.
• Privacy policy is Google's generic policy (scope_extension=false, data_collection=true, third_party_sharing=true) — worst-case privacy disclosure.
• NewTab override with search permission enables search-provider replacement and ad revenue redirection on every new tab.
• 20 months since last update with NewTab override and monetization-linked hijacks — stale attack surface.
• External JS hosts span chatgpt.com, instagram.com, netflix.com, youtube.com — broad link farm embedded in new-tab page.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → gameograf.com with UTM params; install opens haberikra.com — dual monetization redirect.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; search permission also declared — NewTab monetization pattern.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true.
• broad_external_hosts crx 10 external JS hosts including chatgpt.com, instagram.com, netflix.com, x.com — link farm on new-tab page.
• stale_extension store Last updated December 31, 2024; months_since_update=20 — exceeds 18-month staleness threshold.
• install_url_hijack manifest onInstalled opens haberikra.com with utm_campaign=bg; unverified 3rd-party destination.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension with external host references.
• unverified_publisher store verified_publisher=false, is_featured_by_google=false; developer 'Horizon' at gameograf.com with no verification.

Permissions Breakdown

• search medium Allows overriding search provider; paired with newtab override amplifies monetization risk.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary surface for ad monetization and search hijacking.

Pillar Scores

Bookkeeping