Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Honda NSX Anime Girl Zero Two Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall and install URL both hijack to gameograf.com with UTM tracking — clear monetization shell pattern.
• Privacy policy is Google's generic account policy; scope_extension=false and data_collection=true with third-party sharing — worst-case generic policy (+10).
• NewTab override + search permission = classic search-monetization newtab shell; operator cluster has 11 siblings sharing same install/uninstall URL.
• No developer name listed; verified publisher discount capped due to monetization signals (v3.5 rule E).

Evidence

• uninstall_url_hijack crx Uninstall URL redirects to gameograf.com with UTM params branded ovkas — explicit monetization hook on uninstall.
• install_url_hijack crx Install URL also redirects to gameograf.com with same UTM params — double hijack on install and uninstall.
• operator_cluster api Compound fingerprint matches 2 sibling extensions; uninstall_url dim matches 11 siblings — mass NewTab shell operation.
• privacy_policy_generic store Privacy policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• newtab_override manifest chrome_url_overrides.newtab set to index.html — replaces every new-tab page for all users.
• js_external_hosts crx Extension contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — 5 unrelated external domains.
• no_developer_name store developer_name is empty string; no 'Offered by' identity beyond email.
• verified_publisher_cap store Verified publisher discount capped at -1.0 per v3.5 rule E: monetization_hits pathway via gameograf.com install/uninstall hijack.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Honda NSX Anime Girl Zero Two Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 6.29 -> 8.79 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows manipulation of search provider; combined with newtab override is a search-monetization vector.
• chrome_url_overrides.newtab medium Replaces new-tab page; core mechanism for ad-monetization NewTab shells.

Pillar Scores

Operator Siblings (4)

Other extensions sharing this developer's compound fingerprint:

• hbcoidfefbocofajncopoidcoeedahbm
• aijplginpngbkakdlhnjjgmigncndbed
• bjgiiachhcnhldlbpcpblbghcafoakfl
• gdmbnkaaajldcmamodnkchdbnfonpjbb

Bookkeeping