Top Risks

• Uninstall and install URL both hijack to gameograf.com — confirmed monetization shell pattern.
• Privacy policy is generic Google policy (scope_extension=false, data_collection=true, third_party_sharing=true) — worst-case Privacy score.
• NewTab override + 'search' permission enables silent search/ad monetization on every new tab open.
• JS external hosts include gameograf.com plus major platforms (Instagram, Netflix, YouTube, X) — traffic aggregator fingerprint.
• Developer name absent; verified_publisher with Google policy link obscures who actually controls data.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL targets gameograf.com with UTM params — classic monetization shell.
• install_url_hijack crx onInstalled opens gameograf.com with same UTM params — confirms install/uninstall ad-funnel.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab controlled by extension.
• privacy_policy_generic store PP URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true.
• js_external_hosts crx Extension contacts gameograf.com, Instagram, Netflix, YouTube, X — far beyond wallpaper function.
• no_developer_name store developer_name is empty string; identity accountability reduced.
• search_permission_plus_newtab manifest 'search' permission + newtab override is a known search-monetization pattern per rubric.
• csp_absent manifest content_security_policy is null; no script-src restrictions on MV3 extension.

Permissions Breakdown

• search medium Grants access to search provider API; combined with newtab override enables search hijacking.
• chrome_url_overrides.newtab high Replaces every new tab page; monetization vector for ad-tech and search redirection.

Pillar Scores

Bookkeeping