Top Risks

• Uninstall and install URL hijacks both redirect to gameograf.com with UTM tracking — monetization shell pattern.
• Privacy policy is Google's own policy (not scoped to this extension) yet data_collection=true and third_party_sharing=true — effectively no disclosure.
• NewTab override combined with 'search' permission enables silent search-provider monetization.
• Developer uses free Gmail account with no verifiable business identity; no verified publisher badge.
• js_external_hosts includes major platforms (Netflix, Instagram, YouTube, X) — tracking/redirect surface beyond stated wallpaper function.

Evidence

• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=ovkas — classic monetization shell install hijack.
• uninstall_url_hijack crx setUninstallURL points to https://gameograf.com/?utm_source=ovkas — 3rd-party uninstall redirect.
• newtab_override manifest chrome_url_overrides.newtab = index.html replaces every new-tab page.
• privacy_policy_generic store Policy URL is Google's own account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_dev store Developer email fatihkaran600@gmail.com — free webmail, no verified business entity.
• js_external_hosts_broad crx External JS hosts include gameograf.com, instagram.com, netflix.com, youtube.com, x.com — beyond wallpaper function.
• search_permission_newtab_combo manifest 'search' permission + newtab override enables search monetization without declared search-provider override.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening declared.

Permissions Breakdown

• search medium Can manipulate search provider settings; combined with newtab override increases monetization risk.
• chrome_url_overrides.newtab medium Replaces new-tab page; common vector for ad monetization and search hijacking.

Pillar Scores

Bookkeeping