Top Risks

• NewTab override hijacks every new tab; uninstall AND install URL both redirect to gameograf.com monetization domain.
• Privacy policy is Google's generic account policy — does not scope to this extension; admits data collection and 3rd-party sharing.
• Free-webmail developer (gmail) with no verified business; no privacy policy URL relevant to extension.
• JS externally contacts gameograf.com, Netflix, Instagram, YouTube, X — broad reach inconsistent with a wallpaper extension.
• No CSP declared; MV3 default helps but uninstall/install hijack signals a monetization shell pattern.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL points to gameograf.com with UTM tracking params (ovkas campaign).
• install_url_hijack manifest onInstalled opens gameograf.com with matching UTM params — traffic monetization on install.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab is controlled by this extension.
• generic_privacy_policy store Policy URL is Google account policy (479 KB); scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email halilseker3455@gmail.com; no verified publisher, no business domain.
• js_external_hosts_mismatch crx Extension contacts gameograf.com, Netflix, Instagram, YouTube, X — excessive for a wallpaper/newtab.
• new_tab_monetization_shell crx Pattern: wallpaper/fan theme + newtab override + install/uninstall hijack to ad domain = classic monetization shell.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension with external host access.

Permissions Breakdown

• search medium Allows querying/overriding search provider; paired with newtab override this controls default search.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; prime real estate for ad-monetization and traffic capture.

Pillar Scores

Bookkeeping