Top Risks

• Uninstall AND install URL both hijack to gameograf.com with UTM tracking — confirmed monetization shell.
• New-tab override replaces browser homepage for ad/search revenue; search permission stacks on this.
• Privacy policy is Google's own account policy — not scoped to this extension at all (generic policy admits data collection + 3rd-party sharing).
• Free-webmail dev (gmail) with no verified business domain; no verified-publisher badge.
• JS contacts six external hosts (gameograf.com, Instagram, Netflix, YouTube, X, Google) from a wallpaper extension.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com with UTM params tied to 'ovkas' campaign.
• install_url_hijack crx onInstalled opens gameograf.com with identical UTM tracking — monetization on install.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab for wallpaper/search shell.
• generic_privacy_policy store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension; admits data collection + 3rd-party sharing.
• free_webmail_dev store Developer email halilseker3455@gmail.com; no verified publisher; no business domain.
• external_hosts_broad crx JS references: gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com — 6 hosts for a wallpaper.
• new_tab_monetization_shape manifest search permission + newtab override + install/uninstall hijack to same ad domain = classic traffic monetization cluster.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP declared.

Permissions Breakdown

• search medium Allows override of search provider; combined with newtab override forms monetization pattern.
• chrome_url_overrides.newtab medium Replaces new tab page; primary surface for wallpaper shell / search monetization.

Pillar Scores

Bookkeeping