Top Risks

• Uninstall AND install URL hijacked to gameograf.com — classic traffic-monetization shell pattern.
• NewTab override with 'search' permission enables de-facto search engine replacement and ad-revenue capture.
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Free-webmail developer (Gmail) with no verified business identity; no publisher badge.
• Extension contacts 6 external hosts (gameograf.com, Google, Instagram, Netflix, YouTube, X) from a wallpaper app.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → gameograf.com with UTM params; monetization shell fingerprint.
• install_url_hijack manifest onInstalled opens gameograf.com with UTM params; same destination as uninstall URL.
• newtab_override manifest chrome_url_overrides.newtab = index.html; extension controls every new tab session.
• generic_privacy_policy store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email halilseker3455@gmail.com; no verified publisher badge; no business website.
• external_hosts crx JS contacts gameograf.com, Google, Instagram, Netflix, YouTube, X — 6 hosts inconsistent with wallpaper function.
• search_permission_plus_newtab manifest 'search' permission combined with NewTab override enables search hijacking without declared host permissions.
• no_csp crx content_security_policy is null on MV3 extension; no CSP declared.

Permissions Breakdown

• search medium Allows querying the browser search engine; combined with NewTab override enables de-facto search hijack.
• chrome_url_overrides.newtab high Replaces every new tab — prime real estate for ad injection, tracking, and search monetization.

Pillar Scores

Bookkeeping