Top Risks

• Uninstall + install URL both hijack to gameograf.com with UTM tracking — classic monetization shell pattern.
• NewTab override combined with 'search' permission: search-hijacking monetization structure.
• Privacy policy is Google's generic account policy (scope_extension=false, admits data+3rd-party sharing) → worst-case privacy score.
• Free-webmail developer (gmail) with no verifiable business identity and no verified publisher status.
• Extension contacts 6 external JS hosts (Google, Instagram, Netflix, YouTube, X, gameograf.com) from a wallpaper app — scope mismatch.

Evidence

• install+uninstall_url_hijack manifest Both onInstalled and uninstall redirect to gameograf.com with UTM tracking params matching 'ovkas' campaign.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab served by this extension.
• search_permission manifest Declares 'search' permission alongside newtab override — standard search-monetization fingerprint.
• generic_privacy_policy store Privacy policy URL is Google Account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email gizemoge752@gmail.com; no verified publisher, no business domain, no featured badge.
• js_external_hosts_mismatch crx Wallpaper app contacts gameograf.com, Instagram, Netflix, YouTube, X, Google — unrelated to stated function.
• operator_cluster_install_url api install_url dimension shows 8 siblings sharing same gameograf.com install redirect — coordinated shell cluster.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP hardening.

Permissions Breakdown

• search medium Allows overriding search provider; medium risk on its own, combined with newtab override raises monetization concern.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; primary vehicle for ad-monetization and search hijacking.

Pillar Scores

Bookkeeping