Top Risks

• Uninstall and install URL hijack to gameograf.com — confirmed traffic-monetization shell pattern.
• New-tab override with search permission: classic ad-monetization/search-redirect shape.
• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and third-party sharing.
• Free-webmail developer (halilseker3455@gmail.com) with no verifiable business identity.
• JS contacts gameograf.com, Instagram, Netflix, YouTube, X.com — unrelated to a wallpaper extension.

Evidence

• install_url_hijack crx onInstalled opens gameograf.com with UTM params; confirms traffic-monetization intent.
• uninstall_url_hijack crx setUninstallURL points to gameograf.com with UTM; +3.0 Webstore per rubric.
• newtab_override manifest chrome_url_overrides.newtab set to index.html; replaces every new tab for monetization.
• generic_privacy_policy api Policy URL is Google Account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy.
• free_webmail_dev store Developer email halilseker3455@gmail.com with no business domain; Reputation floor 7.5.
• js_external_hosts crx gameograf.com, instagram.com, netflix.com, youtube.com, x.com — unrelated to wallpaper function.
• search_permission_newtab_combo manifest search + newtab override without verified publisher is a known search-hijack monetization cluster.
• no_csp manifest content_security_policy is null; MV3 strict default applies but no explicit CSP declared.

Permissions Breakdown

• search medium Allows overriding search provider; medium risk for search hijacking.
• chrome_url_overrides.newtab medium Replaces new-tab page; monetization shell pattern for ad traffic.

Pillar Scores

Bookkeeping