Top Risks

• Uninstall and install URL both hijack to gameograf.com with UTM tracking — confirmed monetization shell.
• Privacy policy is Google's generic policy (scope_extension=false, admits data collection & 3rd-party sharing) — scores 10.0.
• Minecraft brand impersonation by unverified Gmail developer with no confirmed ownership.
• NewTab override + search permission enables search-revenue monetization against all 270 users on every new tab.
• JS contacts instagram.com, netflix.com, x.com, youtube.com externally — broad reach beyond stated wallpaper function.

Evidence

• install_url_hijack manifest onInstalled opens gameograf.com with UTM campaign tags — monetization shell confirmed.
• uninstall_url_hijack manifest setUninstallURL points to gameograf.com with same UTM tags — +3.0 webstore per rubric.
• brand_impersonation store brand_mention.is_impersonation=true for 'minecraft'; developer not confirmed owner; free Gmail account.
• generic_privacy_policy store Policy is Google's own account policy: scope_extension=false, data_collection=true, third_party_sharing=true → +10.0.
• newtab_override manifest chrome_url_overrides.newtab replaces all new tabs; combined with search permission = ad-monetization vector.
• external_js_hosts crx JS contacts gameograf.com, instagram.com, netflix.com, x.com, youtube.com — broad beyond wallpaper function.
• free_webmail_developer store Developer email halilseker3455@gmail.com — free webmail, no verified business domain.
• no_csp manifest content_security_policy is null (MV3 default applies but no explicit CSP declared).

Permissions Breakdown

• search medium Search API allows overriding search provider; paired with newtab override raises monetization risk.
• chrome_url_overrides.newtab medium Replaces every new tab — high-reach surface for ad injection and search monetization.

Pillar Scores

Bookkeeping