Top Risks

• Uninstall & install URL hijack both redirect to gameograf.com monetization site — classic traffic-monetization shell.
• NewTab override + search permission = search-monetization vector on every new tab for all users.
• Privacy policy is Google's generic account policy — does not scope to this extension at all; admits data collection and 3rd-party sharing.
• Free-webmail developer (gmail) with no business domain and numbered-alias-style email; no verified publisher badge.
• Extension contacts external hosts (gameograf.com, netflix, instagram, youtube, x.com) — broader than stated wallpaper function.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL points to gameograf.com with utm_source=ovkas — 3rd-party monetization redirect.
• install_url_hijack manifest onInstalled opens gameograf.com with utm tracking params — monetization shell confirmed.
• newtab_override manifest chrome_url_overrides.newtab = index.html replaces every new tab page.
• free_webmail_dev store Developer email gayeatakul4@gmail.com; no business domain; unverified publisher.
• generic_privacy_policy store Privacy URL is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true) — triggers +10 privacy.
• js_external_hosts crx JS contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — far beyond wallpaper function.
• new_tab_monetization_shape manifest NewTab override + search permission + install/uninstall URL hijack = textbook monetization shell pattern.
• install_count_anomaly store Only 3 installs with active monetization infrastructure suggests early-stage or test deployment of shell.

Permissions Breakdown

• search medium Allows extension to interact with search functionality; combined with newtab override raises search-hijack risk.
• chrome_url_overrides.newtab high Replaces every new tab with extension-controlled page; primary vector for search monetization and tracking.

Pillar Scores

Bookkeeping