Top Risks

• Uninstall AND install URL both hijack to gameograf.com — explicit monetization/tracking redirect on user lifecycle events.
• NewTab override combined with search permission; every new tab is controlled by this extension.
• Privacy policy URL returns connection error — effectively no accessible privacy policy.
• Free-webmail developer (gmail) with no developer name and no verifiable business domain.
• JS contacts instagram.com, netflix.com, youtube.com, x.com externally — social/media tracking fingerprint in a wallpaper app.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com with UTM campaign=ovkas; explicit 3rd-party redirect on uninstall.
• install_url_hijack crx onInstalled opens gameograf.com with same UTM params; confirms monetization shell pattern.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab for 414 installs.
• privacy_policy_fetch_error api ovkas.com/privacy-policy returned ConnectionError; policy is inaccessible — treated as no policy.
• free_webmail_no_dev_name store Developer email halilseker3455@gmail.com; developer_name empty; no verifiable business identity.
• js_external_hosts_mismatch crx Wallpaper extension contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — unrelated to stated function.
• verified_publisher store verified_publisher=true but discount capped: policy unreachable and free-webmail identity.
• csp_absent_mv3 manifest content_security_policy is null; MV3 default applies but no explicit CSP declared.

Permissions Breakdown

• search medium Allows search provider manipulation; medium risk on its own.
• chrome_url_overrides.newtab high Replaces every new tab; prime monetization surface and user-tracking vector.

Pillar Scores

Bookkeeping