Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Yoda and Darth Vader Live Wallpaper 4K [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall & install URL hijacks redirect to gameograf.com with UTM tracking — classic monetization shell pattern.
• NewTab override with search permission turns every new tab into a monetization surface.
• Privacy policy is Google's generic account policy — completely unscoped to this extension; admits data collection and 3rd-party sharing.
• Free-webmail developer (gmail), no developer name, no business website — unverifiable identity.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com with UTM tracking params; textbook monetization redirect.
• install_url_hijack crx onInstalled opens gameograf.com with same UTM params; install hijack confirmed.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab controlled by extension.
• privacy_policy_generic store Policy URL is Google account privacy page: scope_extension=false, data_collection=true, third_party_sharing=true.
• developer_identity store Developer email is free Gmail, developer_name empty, no business domain — unverifiable operator.
• js_external_hosts crx Extension references instagram.com, netflix.com, youtube.com, x.com — unrelated to wallpaper function.
• game_portal_shell crx gameograf.com UTM target matches game-portal shell pattern with campaign/content tracking.
• verified_publisher_limited store verified_publisher=true but monetization hits (install/uninstall hijack) cap discount to -1.0 per v3.5 invariant 0c/E.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Yoda and Darth Vader Live Wallpaper 4K [adware] + malext.io malicious_extension_sentry; score 6.19 -> 8.69 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading and modifying search queries; combined with newtab override increases monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab with extension-controlled page; primary surface for ad-monetization shells.

Pillar Scores

Bookkeeping