Top Risks

• Uninstall and install URL both hijack to gameograf.com with UTM tracking — classic monetization shell pattern.
• Privacy policy is Google's generic account policy; scope_extension=false, data_collection=true, third_party_sharing=true → scores 10.0.
• NewTab override + search permission gives full control of user's search experience and monetization funnel.
• Free-webmail developer (fatihkaran600@gmail.com) with no verified business identity.
• JS contacts 6 external hosts (gameograf.com, YouTube, Netflix, Instagram, X, Google) from a wallpaper extension — excessive reach.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → gameograf.com with ovkas UTM params; clear 3rd-party monetization redirect.
• install_url_hijack manifest onInstalled opens gameograf.com with ovkas UTM params; install-time traffic hijack confirmed.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab for monetization.
• generic_privacy_policy store Privacy policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email fatihkaran600@gmail.com; no verified business domain or publisher badge.
• js_external_hosts crx Extension contacts gameograf.com, YouTube, Netflix, Instagram, X, Google — 6 hosts for a wallpaper.
• search_permission_newtab manifest search permission combined with newtab override enables full search hijack monetization.
• no_csp manifest content_security_policy is null; no CSP hardening on MV3 extension.

Permissions Breakdown

• search medium Allows overriding default search; combined with NewTab override creates full search monetization surface.
• chrome_url_overrides.newtab medium Replaces every new tab with extension page; primary monetization vector for game-portal shells.

Pillar Scores

Bookkeeping