Top Risks

• Uninstall and install URL both hijacked to gameograf.com — confirmed monetization shell pattern.
• New-tab override combined with search permission: classic ad-revenue capture mechanism.
• Privacy policy is generic Google policy with no extension scope; admits data collection and 3rd-party sharing.
• No developer name disclosed; Avengers brand implied in title without confirmed IP ownership.
• JS contacts instagram.com, netflix.com, youtube.com, x.com — broad social/media reach from a wallpaper app.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com with UTM params; confirms monetization shell.
• install_url_hijack crx onInstalled opens gameograf.com with UTM params; traffic-monetization pattern.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab for search monetization.
• generic_privacy_policy store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension.
• broad_js_external_hosts crx JS contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — unexplained for a wallpaper.
• no_developer_name store developer_name is empty string; reduces accountability.
• verified_publisher store verified_publisher=true but monetization hits present; v3.5(E) caps discount at -1.0.
• privacy_policy_admits_3p_sharing api Classification: scope_extension=false, data_collection=true, third_party_sharing=true → v3.5(D) +10.0.

Permissions Breakdown

• search medium Allows search provider interaction; paired with newtab override raises monetization concern.
• chrome_url_overrides.newtab high Replaces new tab page; core vector for ad-monetization and search hijacking.

Pillar Scores

Bookkeeping