Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Cristiano Ronaldo With Portugal-Themed Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall and install URL hijack both redirect to gameograf.com, a clear monetization/tracking shell pattern.
• New-tab override with game-portal monetization domain (gameograf.com) — classic traffic-monetization shell.
• Privacy policy is Google's generic policy (scope_extension=false, admits data collection and 3rd-party sharing) — worst-case privacy rating.
• Free-webmail developer (gmail) with no verified publisher badge and no business domain — unaccountable operator.

Evidence

• install_url_hijack + uninstall_url_hijack manifest Both onInstalled and uninstall events redirect to gameograf.com with UTM tracking — monetization shell pattern.
• newtab_override manifest chrome_url_overrides.newtab set to index.html; replaces every new tab for 569 users.
• js_external_hosts crx Contacts gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com — 4 unrelated major platforms.
• generic_privacy_policy store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email haliliseker44@gmail.com; no verified publisher badge; no business domain.
• game_portal_shell crx gameograf.com UTM params include utm_source=ovkas, consistent with operator network of themed wallpaper shells.
• csp_absent manifest content_security_policy is null; MV3 default applies but no explicit hardening declared.
• no_rating store 0 ratings, 569 installs — no community signal to assess trustworthiness.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Cristiano Ronaldo With Portugal-Themed Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.13 -> 7.63 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/manipulating search queries; paired with newtab override indicates search monetization intent.
• chrome_url_overrides.newtab medium Replaces new tab page; monetization vector, drives traffic to gameograf.com.

Pillar Scores

Bookkeeping