Top Risks

• Uninstall and install URL hijacks redirect users to yowgames.com with UTM tracking — monetization shell pattern.
• Privacy policy is not scoped to this extension, admits data collection and third-party sharing (D rule: +10.0 privacy).
• Content scripts run on *://*/* injecting into every page, despite only 'storage' in permissions[].
• Free-webmail developer (busrakaraman256@gmail.com) with no verified business identity.
• Policy hosted on yowgames.com — a third-party game portal domain unrelated to stated developer 'wallpaperlive'.

Evidence

• install_url_hijack manifest onInstalled opens yowgames.com with UTM params — game-portal install hijack pattern.
• uninstall_url_hijack manifest setUninstallURL points to yowgames.com with UTM params — Webstore +3.0 per rubric.
• privacy_policy_generic store Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → Privacy +10.0 (rule D).
• free_webmail_dev store busrakaraman256@gmail.com — numbered alias Gmail, no verified business domain.
• content_scripts_broad crx content_scripts_matches=[*://*/*] injects into all pages; high reach despite minimal declared permissions.
• no_csp crx content_security_policy is null (MV3 default applies, no custom CSP specified).
• jquery_bundled crx jQuery 3.6.0 bundled; no CVEs found in cve_findings_raw, but no CSP hardening present.
• developer_domain_mismatch store Developer name 'wallpaperlive', email gmail.com, privacy policy on yowgames.com — inconsistent identity.

Permissions Breakdown

• storage low Stores cursor preferences locally; low standalone risk.
• content_scripts *://*/* high Injects JS into every page on every site; broad reach despite narrow declared permissions.

Pillar Scores

Bookkeeping