Top Risks

• NewTab override + uninstall/install URL hijack both pointing to gameograf.com — classic ad-monetization shell pattern.
• Privacy policy is Google's own policy (scope_extension=false, data_collection=true, third_party_sharing=true) — triggers +10.0 per v3.5 rule D.
• Free-webmail developer (gmail), no developer name, verified_publisher flag unlikely to reflect genuine accountability.
• JS external hosts include gameograf.com, Instagram, Netflix, YouTube, X — 6 unrelated origins for a wallpaper/NewTab extension.
• Uninstall and install URL hijack to gameograf.com with UTM tracking confirms monetization shell intent.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → gameograf.com with ovkas UTM params; +3.0 Webstore.
• install_url_hijack manifest onInstalled opens gameograf.com with same UTM params; +2.0 Webstore.
• newtab_override manifest chrome_url_overrides.newtab = index.html; high-reach ad surface; +2.0 Permissions, +2.0 Webstore.
• generic_google_privacy_policy store Policy is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy.
• free_webmail_no_dev_name store Developer email halilseker3455@gmail.com, developer_name empty; +1.5 Reputation (free webmail) +1.0 (no name).
• js_external_hosts crx 6 external hosts: gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com — unrelated to wallpaper function.
• no_csp manifest content_security_policy is null (MV3 default strict applies but csp_present=false noted).
• verified_publisher_low_installs store verified_publisher=true but only 127 installs, gmail dev, monetization hits present; 0c cap limits discount to -1.0.

Permissions Breakdown

• search medium Grants ability to query the browser's search service; combined with newtab override raises monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab page; high-reach surface for ad injection and search redirection.

Pillar Scores

Bookkeeping