Top Risks

• Uninstall and install URL both hijack to gameograf.com — classic monetization shell pattern.
• Privacy policy is Google's own account policy, not scoped to this extension; admits data collection and 3rd-party sharing.
• NewTab override combined with 'search' permission enables persistent search/ad monetization on every new tab.
• js_external_hosts includes gameograf.com, Instagram, Netflix, YouTube, X — far beyond wallpaper functionality.
• No developer name provided; verified publisher discount constrained by monetization redirect signals.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL targets gameograf.com with ovkas UTM params — monetization shell indicator.
• install_url_hijack crx onInstalled opens gameograf.com with same UTM params — install redirect monetization pattern.
• newtab_override manifest chrome_url_overrides.newtab=index.html replaces every new tab; combined with 'search' permission.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension.
• privacy_admits_sharing api Classification: scope_extension=false, data_collection=true, third_party_sharing=true — worst-case generic policy.
• broad_external_hosts crx JS contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — far beyond wallpaper need.
• no_developer_name store developer_name is empty string; reduces accountability despite verified_publisher=true.
• verified_publisher_monetization_cap store Invariant 0c/E: monetization redirect hits cap verified-publisher discount to -1.0 max.

Permissions Breakdown

• search medium Allows querying browser search API; combined with newtab override enables search hijacking.
• chrome_url_overrides.newtab high Replaces every new tab with extension page — primary monetization surface for NewTab shells.

Pillar Scores

Bookkeeping