Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Itachi Uchiha Moonlight Crow Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall and install URL both hijacked to gameograf.com — confirmed monetization shell pattern.
• Privacy policy is Google's generic account policy; does not scope to this extension at all, admits data+3rd-party sharing.
• NewTab override + search permission = search-engine hijacking surface on every new tab.
• Developer email is free webmail (gmail), no developer name, no business domain — identity unverifiable.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → gameograf.com with UTM params; classic monetization shell.
• install_url_hijack manifest onInstalled opens gameograf.com with UTM params — traffic monetization on install.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab controlled by extension.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, scope_extension=false, admits 3rd-party sharing.
• js_external_hosts crx 6 external JS hosts: gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com.
• free_webmail_no_devname store developer_name empty, email halilseker3455@gmail.com — no verifiable business identity.
• new_tab_monetization_shape store NewTab + uninstall/install hijack + gameograf.com = textbook low-effort traffic-monetization cluster.
• verified_publisher store Verified publisher badge present but email is free webmail; discount capped due to monetization pattern.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Itachi Uchiha Moonlight Crow Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.72 -> 8.22 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows search provider manipulation; paired with newtab override amplifies monetization risk.
• chrome_url_overrides.newtab high Replaces every new-tab page; core vector for ad-monetization and search hijacking.

Pillar Scores

Bookkeeping