Top Risks

• Uninstall URL hijack to yowgames.com and install URL hijack — classic monetization/tracking shell pattern.
• New-tab override replaces every new tab; combined with search permission enables search-provider monetization.
• Privacy policy URL is Google's own account policy (unfetchable/generic), not scoped to this extension.
• Free-webmail developer (gmail) with no verified business identity or publisher badge.
• JS external hosts include chat.openai.com, Netflix, Instagram, YouTube, X — far exceeds a wallpaper extension's stated function.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → https://yowgames.com/uninstall; 3rd-party tracking on uninstall.
• install_url_hijack manifest onInstalled opens https://yowgames.com/terraria-live-wallpaper; 3rd-party URL on install.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab hijacked.
• js_external_hosts_mismatch crx 8 external hosts including Netflix, Instagram, YouTube, X, OpenAI — unrelated to a wallpaper extension.
• privacy_policy_unfetchable store Policy URL is Google account policy; fetch_error:ConnectionError; not scoped to this extension.
• free_webmail_developer store Developer email sonerrgulay93@gmail.com; no verified publisher; no business domain.
• new_tab_monetization_shape manifest NewTab override + search permission + yowgames.com install/uninstall hooks = monetization shell.
• csp_absent_mv3 manifest content_security_policy is null; no explicit CSP declared despite external host references.

Permissions Breakdown

• search medium Allows reading/modifying default search provider; medium risk in context of NewTab override.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; prime surface for monetization and data capture.

Pillar Scores

Bookkeeping