Top Risks

• Uninstall AND install URL hijacked to gameograf.com with UTM tracking — explicit monetization shell pattern.
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing (+10 privacy).
• Free-webmail developer (halilseker3455@gmail.com), no verified publisher, no business domain — high-reputation risk.
• NewTab override combined with search permission creates full search-monetization surface area.
• JS contacts gameograf.com, Instagram, Netflix, YouTube, X — 5 unrelated external hosts with no justified purpose.

Evidence

• uninstall_url_hijack manifest setUninstallURL → gameograf.com with utm_source=ovkas; explicit monetization redirect on remove.
• install_url_hijack manifest onInstalled opens gameograf.com with utm_source=ovkas; affiliate/monetization shell confirmed.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab captured for monetization.
• privacy_policy_generic store Policy URL is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true); +10 privacy.
• free_webmail_developer store Developer email halilseker3455@gmail.com; no verified publisher; no business domain.
• js_external_hosts crx 6 external JS hosts: gameograf.com, google, instagram, netflix, youtube, x.com — >3 unrelated domains.
• no_csp manifest content_security_policy is null; MV3 defaults apply but no explicit hardening.
• new_tab_monetization_shape store Anime-wallpaper shell with NewTab override + search perm + gameograf.com affiliate UTM = monetization pattern.

Permissions Breakdown

• search medium Allows reading/overriding search provider; medium risk for a NewTab/wallpaper extension.
• chrome_url_overrides.newtab medium Replaces every new tab page; primary monetization surface for this shell.

Pillar Scores

Bookkeeping