Top Risks

• Uninstall AND install URL both hijack to gameograf.com ad-tech domain — confirmed monetization shell pattern.
• NewTab override + search permission = full search-monetization capability on every new tab.
• Privacy policy is Google's generic account policy — scope_extension=false, data_collection=true, third_party_sharing=true; qualifies for +10.0 under v3.5 rule D.
• Free-webmail dev (halilseker3455@gmail.com), no verified publisher, no business website — unaccountable operator.
• External JS hosts include major platforms (Netflix, YouTube, Instagram, X) plus gameograf.com with UTM tracking — suspicious host diversity for a wallpaper extension.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → gameograf.com with ovkas UTM params; confirmed monetization shell.
• install_url_hijack manifest onInstalled opens gameograf.com with identical UTM params; install redirect pattern confirmed.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab with extension controlled page.
• privacy_policy_generic store Policy URL is myaccount.google.com — Google's own policy, scope_extension=false, admits data collection & 3rd-party sharing.
• free_webmail_dev store Developer email halilseker3455@gmail.com; no verified publisher, no business domain, no recognized org.
• external_hosts_diversity crx JS contacts gameograf.com, google, instagram, netflix, youtube, x.com — 6 unrelated domains for a wallpaper.
• game_portal_shell crx gameograf.com is a game-portal domain; both hijack URLs point there with campaign tracking params.
• search_permission_newtab_combo manifest search permission + newtab override enables full search provider takeover for ad-monetization.

Permissions Breakdown

• search medium Allows manipulation of search provider; paired with newtab override amplifies search-monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; primary monetization surface for ad-tech shells.

Pillar Scores

Bookkeeping