Top Risks

• Uninstall AND install URL both hijacked to gameograf.com with UTM tracking — classic monetization shell pattern.
• Privacy policy is Google's own generic policy (not scoped to this extension) yet admits data collection and third-party sharing — scores as worst-case.
• NewTab override + 'search' permission creates full search-monetization surface; ext replaces every new tab.
• Free-webmail developer (halilseker3455@gmail.com) with no verified business identity or publisher badge.
• External JS hosts include google, instagram, netflix, youtube, x.com — broad outbound contact beyond stated wallpaper function.

Evidence

• install_url_hijack crx onInstalled opens gameograf.com with UTM params utm_source=ovkas — confirmed install URL hijack.
• uninstall_url_hijack crx setUninstallURL points to gameograf.com with UTM params — confirmed uninstall URL hijack to 3rd party.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab with extension-controlled page.
• privacy_policy_generic store PP URL is myaccount.google.com/privacypolicy — Google's generic policy, not scoped to this extension; admits data+3rd-party sharing.
• free_webmail_developer store Developer email halilseker3455@gmail.com; no verified publisher badge; no business website.
• external_js_hosts crx Extension contacts 6 external hosts: gameograf.com, google, instagram, netflix, youtube, x.com — far beyond wallpaper scope.
• search_permission_with_newtab manifest 'search' permission combined with newtab override enables full search-provider monetization pattern.
• no_csp crx content_security_policy is null; MV3 default applies but no explicit CSP hardens against injection.

Permissions Breakdown

• search medium Allows manipulation of Chrome search settings; combined with newtab override creates full search-monetization surface.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; core mechanism for traffic/ad monetization shells.

Pillar Scores

Bookkeeping