Top Risks

• Uninstall and install URL hijacks both redirect to gameograf.com ad-campaign URL — textbook monetization shell.
• Privacy policy is generic Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true) — worst-case privacy score.
• NewTab override + search permission with free-webmail dev, no developer name, no business domain — classic traffic-monetization pattern.
• JS external hosts include google.com, instagram.com, netflix.com, youtube.com, x.com alongside gameograf.com — broad external reach from wallpaper extension.
• Verified publisher badge does NOT sufficiently discount risk: monetization_hits analog present via gameograf.com hijack URLs (0c cap applies).

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → gameograf.com UTM campaign; +3.0 Webstore.
• install_url_hijack manifest onInstalled opens gameograf.com UTM URL; +2.0 Webstore.
• newtab_override manifest chrome_url_overrides.newtab = index.html; +2.0 Webstore, high permission risk.
• privacy_policy_generic store Policy is Google account policy: scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy (D rule).
• free_webmail_no_dev_name store Dev email halilseker3455@gmail.com, developer_name empty → Reputation floor 7.5.
• js_external_hosts crx 6 external JS hosts: gameograf.com + major platforms; unexpected breadth for a wallpaper/newtab.
• verified_publisher_cap_0c store Verified publisher discount capped at -1.0 due to gameograf.com monetization-linked URL hijacks (v3.5 0c/E).
• no_csp manifest csp_present=false on MV3; no additional MV2 penalty but no mitigation either.

Permissions Breakdown

• search medium Allows search provider manipulation; paired with newtab override amplifies monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; core surface for ad-monetization shells.

Pillar Scores

Bookkeeping