Top Risks

• Uninstall AND install URL hijack to gameograf.com with UTM tracking — classic traffic-monetization shell.
• NewTab override replaces every new tab; combined with 'search' permission enables search-traffic capture.
• Privacy policy is Google's own generic policy — not scoped to this extension; admits data collection and 3rd-party sharing (+10).
• Free-webmail developer (gmail), no business website, no verified publisher — unaccountable operator.
• Extension contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — wide external reach for a wallpaper.

Evidence

• install_url_hijack manifest onInstalled opens gameograf.com with UTM ovkas params — monetization redirect on install.
• uninstall_url_hijack manifest setUninstallURL targets gameograf.com with UTM ovkas params — traffic harvesting on uninstall.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab hijacked by wallpaper/monetization shell.
• privacy_policy_generic store Policy is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension; data_collection+3rd_party_sharing true.
• free_webmail_developer store Developer email halilseker3455@gmail.com; no business domain; no verified publisher badge.
• js_external_hosts crx JS contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — excessive for a wallpaper.
• search_permission_newtab manifest 'search' permission + newtab override together enable search-provider monetization pattern.
• game_portal_shell store gameograf.com domain in install/uninstall URLs matches known game-portal shell monetization pattern.

Permissions Breakdown

• search medium Allows reading/overriding search provider; paired with newtab override amplifies monetization risk.
• chrome_url_overrides.newtab medium Replaces new-tab page; core mechanism for traffic monetization and search hijack.

Pillar Scores

Bookkeeping