Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Call of Duty Black Ops 3 Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall and install URL both hijacked to gameograf.com affiliate/monetization domain — classic adware shell pattern.
• NewTab override replaces every new tab; paired with 'search' permission enables search monetization.
• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and third-party sharing.
• JS contacts google.com, instagram.com, netflix.com, youtube.com, x.com from NewTab page — broad tracking surface on popular sites.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL -> gameograf.com with utm_source=ovkas; affiliate monetization on uninstall.
• install_url_hijack crx onInstalled opens gameograf.com with utm tracking params; monetization shell pattern confirmed.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab controlled by extension.
• generic_privacy_policy store Policy URL is Google's account privacy policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• external_js_hosts crx 6 external hosts contacted: gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com.
• search_permission_newtab_combo manifest 'search' permission + newtab override = search monetization capability.
• no_csp manifest content_security_policy is null; no CSP protection despite 6 external JS host references.
• low_install_monetization_shell store 505 installs, game-themed wallpaper framing conceals newtab monetization shell with affiliate redirect hooks.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Call of Duty Black Ops 3 Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.59 -> 8.09 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding search behavior; combined with newtab override amplifies search monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab with extension-controlled page; primary monetization vector.

Pillar Scores

Operator Siblings (4)

Other extensions sharing this developer's compound fingerprint:

• aijplginpngbkakdlhnjjgmigncndbed
• ceaebmnkmaofbkkgilgmikncajiiohec
• bjgiiachhcnhldlbpcpblbghcafoakfl
• gdmbnkaaajldcmamodnkchdbnfonpjbb

Bookkeeping