Top Risks

• NewTab override + search permission: classic search-hijack monetization shell with only 234 installs.
• Privacy policy URL (haberikra.com) could not be fetched — policy is unverifiable; scored as absent.
• Uninstall URL hijack and install URL hijack both active — aggressive monetization/tracking pattern.
• Developer name missing; privacy policy hosted on unrelated domain (haberikra.com vs gameograf.com).
• innerHTML DOM-XSS sink in popup.js with no CSP; MV3 partial mitigation but sink still present.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html; combined with search permission = search-hijack surface.
• uninstall_url_hijack crx setUninstallURL points to gameograf.com with UTM params — webstore +3.0.
• install_url_hijack crx onInstalled opens gameograf.com with UTM params — webstore +2.0.
• privacy_policy_fetch_failed api fetch_error:ReadTimeout on haberikra.com/privacy-policy/ — treated as no policy; privacy pillar = 10.0.
• privacy_policy_domain_mismatch store Policy URL domain haberikra.com differs from developer domain gameograf.com — credibility concern.
• dom_xss_sink crx innerHTML user-controlled sink in js/popup.js with no CSP present.
• developer_name_missing store developer_name is empty string — no 'Offered by' identity; reputation +1.0.
• stale_14mo store 14 months since update — maintenance pillar +6.0 (6-12mo band upper edge, capped at 6.0).

Permissions Breakdown

• search medium Allows overriding search provider behavior; medium risk for a wallpaper/NewTab extension.
• host_permissions: https://api.gameograf.com/* low Scoped to dev-controlled domain; low risk on its own.
• chrome_url_overrides.newtab medium Replaces new-tab page; high-frequency touch-point enabling monetization or search hijack.

Pillar Scores

Bookkeeping