Top Risks

• Uninstall URL and install URL both hijacked to gameograf.com with UTM tracking — classic traffic-monetization shell.
• Privacy policy is Google's generic account policy: scope_extension=false, data_collection=true, third_party_sharing=true — worst-case privacy score.
• NewTab override + search permission with gameograf.com as JS external host; monetization aggregator pattern.
• Free-webmail developer (gmail), no verified publisher, no business domain — no accountability.
• Extension links to major social/streaming platforms (Netflix, Instagram, YouTube, X) with no stated functional reason.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → gameograf.com with UTM tracking params; textbook monetization shell.
• install_url_hijack manifest onInstalled opens gameograf.com with UTM tracking; double traffic-hijack confirmed.
• newtab_override manifest chrome_url_overrides.newtab = index.html replaces every new tab for all users.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension; data_collection+3rd_party_sharing=true.
• free_webmail_dev store Developer email fatihkaran600@gmail.com; no business domain, no verified publisher badge.
• js_external_hosts crx Extension contacts gameograf.com, Netflix, Instagram, YouTube, X.com — unrelated to an anime wallpaper function.
• new_tab_monetization_pattern manifest NewTab + search override + UTM-tracked uninstall/install URLs + gameograf.com host = monetization aggregator.
• no_csp manifest content_security_policy is null; MV3 strict-default applies but no explicit CSP set.

Permissions Breakdown

• search medium Allows reading/overriding search provider; paired with NewTab override amplifies search monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; primary surface for traffic/ad monetization.

Pillar Scores

Bookkeeping