Top Risks

• Uninstall + install URL hijack both redirect to gameograf.com ad-campaign URL — classic monetization shell.
• Privacy policy is Google's generic account policy, not scoped to this extension; admits data collection and 3rd-party sharing.
• NewTab override + 'search' permission = full search monetization surface on every new tab.
• Free-webmail developer (halilseker3455@gmail.com), no developer name, no business website — unverifiable identity.
• JS contacts 6 external hosts (gameograf.com, Instagram, Netflix, YouTube, X, Google) from a wallpaper/NewTab extension.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com with UTM campaign params; monetization shell fingerprint.
• install_url_hijack crx onInstalled opens gameograf.com with identical UTM params; double hijack confirmed.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab for ad-monetization.
• generic_privacy_policy store PP is myaccount.google.com — Google's own policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_no_dev_name store Developer email gmail.com, developer_name empty — unverifiable identity.
• js_external_hosts crx 6 external hosts: gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com — broad for a wallpaper.
• verified_publisher_limited_discount store verified_publisher=true but free-webmail dev + monetization hijack; discount capped per invariant 0c/E.
• newtab_monetization_webstore manifest NewTab override + uninstall/install hijack to ad-campaign URL = textbook traffic-monetization cluster.

Permissions Breakdown

• search medium Allows reading/manipulating search queries; paired with newtab override amplifies risk.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; primary monetization surface for this category.

Pillar Scores

Bookkeeping