Top Risks

• Uninstall URL hijack and install URL hijack both redirect to gameograf.com with UTM tracking — clear monetization shell.
• Privacy policy is Google's own policy (scope_extension=false, data_collection=true, third_party_sharing=true) — D-rule applies: +10.0.
• NewTab override with free-webmail Gmail dev, no verified publisher, no business domain — high impersonation/abandonment risk.
• JS external hosts include instagram.com, netflix.com, youtube.com, x.com alongside gameograf.com — far beyond newtab wallpaper scope.
• Free-webmail developer email with no business domain; floor reputation at 7.5.

Evidence

• uninstall_url_hijack manifest onUninstall redirects to gameograf.com with utm_source=ovkas — monetization tracking on uninstall.
• install_url_hijack manifest onInstalled opens gameograf.com with utm_source=ovkas — monetization tracking on install.
• newtab_override manifest chrome_url_overrides.newtab set to index.html; replaces every new tab page.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0.
• free_webmail_developer store Developer email halilseker3455@gmail.com; no business domain; reputation floor 7.5.
• js_external_hosts_oop crx Extension contacts instagram.com, netflix.com, youtube.com, x.com — unrelated to live wallpaper function.
• webstore_installs_low store Only 47 installs; tail-attack-surface not flagged but new low-trust extension.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.

Permissions Breakdown

• search medium Allows reading/modifying search queries; paired with newtab override amplifies search monetization risk.
• chrome_url_overrides.newtab medium Replaces every new tab with extension page; primary vector for traffic monetization.

Pillar Scores

Bookkeeping