Top Risks

• Uninstall and install URL both hijacked to gameograf.com — confirmed monetization shell pattern.
• Privacy policy is Google's generic account policy; scope_extension=false, data_collection=true, third_party_sharing=true → worst-case privacy score.
• NewTab override with 'search' permission: classic ad/search-monetization vector with no disclosed data handling.
• Free-webmail developer (gmail), no verified publisher, no business website — low accountability.
• JS contacts gameograf.com, Instagram, Netflix, YouTube, X.com — broad external reach for a wallpaper extension.

Evidence

• install_url_hijack + uninstall_url_hijack manifest Both onInstalled and uninstall redirect to gameograf.com with UTM tracking — confirmed monetization shell.
• chrome_url_overrides.newtab manifest Replaces new tab with index.html; paired with 'search' permission creates search monetization surface.
• privacy_policy_generic store Policy URL is Google's own account policy (scope_extension=false, data_collection=true, third_party_sharing=true).
• free_webmail_dev store Developer email halilibrahimseker125@gmail.com; no verified publisher, no business domain.
• js_external_hosts crx Extension JS references gameograf.com, instagram.com, netflix.com, youtube.com, x.com — 6 external hosts.
• install_url_target_gameograf manifest gameograf.com is a game-portal/monetization domain receiving UTM-tagged traffic from every install/uninstall.
• csp_absent_mv3 manifest No content_security_policy declared; MV3 provides strict default but no explicit CSP for inline code control.
• low_install_newtab store 294 installs, 0 ratings — minimal community vetting for an extension that overrides every new tab.

Permissions Breakdown

• search medium Allows querying/manipulating browser search; combined with newtab override amplifies search monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab; primary vector for ad/search monetization and data exposure.

Pillar Scores

Bookkeeping