Top Risks

• Uninstall AND install URL both hijacked to gameograf.com with UTM tracking — monetization shell pattern.
• New-tab override with 'search' permission: classic search-traffic monetization vector.
• Privacy policy is generic Google account policy — scope_extension=false, data_collection=true, third_party_sharing=true (+10.0 privacy).
• Free-webmail dev (halilseker3455@gmail.com) with no business domain; no verified publisher badge.
• JS contacts gameograf.com, Instagram, Netflix, YouTube, X — far broader than wallpaper functionality warrants.

Evidence

• install+uninstall URL hijack crx Both onInstall and onUninstall redirect to gameograf.com with UTM params; textbook monetization shell.
• newtab override manifest chrome_url_overrides.newtab=index.html replaces new-tab; combined with search permission = ad-traffic capture.
• generic Google privacy policy store Policy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free-webmail developer store Dev email halilseker3455@gmail.com; numbered alias pattern; no business domain; not verified publisher.
• broad external JS hosts crx JS contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — excessive for a wallpaper/newtab.
• new-tab monetization + install hijack cluster crx Webstore: newtab override +2.0, install hijack +2.0, uninstall hijack +3.0, numbered-alias email +3.0.
• no CSP declared manifest content_security_policy is null; MV3 has strict default but no explicit policy declared.
• low installs with high-risk architecture store 616 installs; tail-attack-surface not flagged by tool, but newtab+search+hijack trio is high-risk regardless.

Permissions Breakdown

• search medium Allows interaction with browser search; paired with newtab override raises monetization concern.
• chrome_url_overrides.newtab high Replaces new-tab page with extension content; primary mechanism for search-traffic monetization.

Pillar Scores

Bookkeeping