Top Risks

• Uninstall AND install URL hijack to gameograf.com with UTM tracking — classic monetization shell pattern.
• NewTab override replaces every new tab; combined with 'search' permission enables search-traffic hijacking.
• Privacy policy is Google's generic account policy — has no scope to this extension, admits data collection and 3rd-party sharing.
• Free-webmail developer (gmail) with no verified business identity; extension title uses Mercedes-Benz brand implying false association.
• External JS hosts include instagram.com, netflix.com, youtube.com, x.com — far beyond stated wallpaper function.

Evidence

• install+uninstall URL hijack manifest Both onInstalled and uninstall redirect to gameograf.com with ovkas UTM params — confirmed monetization shell.
• newtab override manifest chrome_url_overrides.newtab = index.html; every new tab captured by extension.
• search permission manifest Declared 'search' permission enables querying/overriding browser search alongside newtab.
• generic Google privacy policy store Policy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free-webmail developer store Developer email ulasaskin728@gmail.com; no verified publisher; no business domain.
• external JS hosts anomaly crx JS contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — unrelated to wallpaper function.
• install URL hijack pattern manifest install_url_hijack=true pointing to gameograf.com; game-portal shell pattern confirmed.
• brand title misuse store Title contains 'Mercedes-Benz'; developer is gmail user with no affiliation; reputational impersonation risk.

Permissions Breakdown

• search medium Allows querying the browser's search engine; combined with newtab override enables full search hijack.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; primary vector for traffic monetization.

Pillar Scores

Bookkeeping