Top Risks

• NewTab override + 'search' permission enables full search-provider hijacking monetized via gameograf.com
• Both install and uninstall URL hijack to gameograf.com with UTM tracking — classic monetization shell
• Privacy policy is Google's generic policy (scope_extension=false, admits data collection+3rd-party sharing) → +10 privacy
• Free-webmail developer (gmail) with no business domain; numbered-alias pattern (halilseker3455)
• No CSP declared; JS contacts 6 external hosts including social/streaming sites unrelated to wallpaper function

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com with ovkas UTM tracking params.
• install_url_hijack crx onInstalled opens gameograf.com with ovkas UTM — monetization on every install event.
• newtab_override manifest chrome_url_overrides.newtab = index.html; overrides every new tab for all users.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email halilseker3455@gmail.com; numbered alias, no business domain.
• js_external_hosts crx 6 external hosts: gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP declared.
• numbered_alias_email store halilseker3455 matches numbered-alias dev pattern (+3.0 webstore per rubric).

Permissions Breakdown

• search medium Allows querying search engine; combined with newtab override enables search hijacking.
• chrome_url_overrides.newtab high Replaces every new tab — primary monetization vector for this category.

Pillar Scores

Bookkeeping