Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Black Hole Astronaut Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall and install URL hijack both redirect to gameograf.com ad/monetization portal — classic traffic-monetization shell.
• Privacy policy is Google's generic account policy, not scoped to this extension — admits data collection and 3rd-party sharing.
• NewTab override + 'search' permission routes every new tab through developer-controlled page with external JS hosts.
• External JS hosts include instagram.com, netflix.com, youtube.com, x.com — unexplained reach for a wallpaper extension.

Evidence

• install_url_hijack + uninstall_url_hijack manifest Both install and uninstall events redirect to gameograf.com with UTM tracking — textbook monetization shell pattern.
• chrome_url_overrides.newtab manifest NewTab override to index.html; combined with search permission and external JS hosts reveals monetization intent.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• js_external_hosts crx Extension contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — unexplained for a wallpaper extension.
• free_webmail_developer store Developer email travyanci4@gmail.com; no verified publisher badge; developer_name dekuy.com unverifiable.
• new_tab_override_with_monetization manifest NewTab + uninstall/install URL hijack to gameograf.com = classic low-effort traffic-monetization cluster.
• no_csp crx content_security_policy is null (csp_present=false); MV3 default applies but no explicit CSP declared.
• operator_fingerprint api Operator fingerprint ties travyanci4@gmail.com to gameograf.com install/uninstall targets and broad social-media host list.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Black Hole Astronaut Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 6.03 -> 8.53 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/overriding search queries; combined with newtab override elevates risk.
• chrome_url_overrides.newtab high Replaces every new tab; primary monetization vector for wallpaper/shell extensions.

Pillar Scores

Bookkeeping