Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Jingliu Anime Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall AND install URL hijacked to gameograf.com — classic monetization shell: earns affiliate/ad revenue on every install/uninstall.
• New-tab override (chrome_url_overrides) replaces every new tab; combined with search permission enables full search monetization.
• Privacy policy is Google's own policy (not scoped to this extension); fetched policy admits data collection and third-party sharing — +10 privacy.
• Free-webmail developer (halilseker3455@gmail.com) with no business website and no verified publisher badge — identity unverifiable.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL targets gameograf.com with UTM params — monetization shell pattern, +3.0 Webstore.
• install_url_hijack crx onInstalled opens gameograf.com with UTM params — install URL hijack, +2.0 Webstore.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab goes through extension page.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy (v3.5-D).
• free_webmail_dev store Developer email halilseker3455@gmail.com, no business domain, no verified publisher → Reputation floor 7.5.
• js_external_hosts crx Extension loads/contacts gameograf.com + major social/media sites; gameograf.com is operator's own domain.
• search_permission_newtab manifest search permission + newtab override = search query monetization surface even without broad host access.
• no_csp crx content_security_policy is null (csp_present=false); MV3 has stricter defaults but no explicit CSP declared.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Jingliu Anime Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.63 -> 8.13 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/manipulating search queries; paired with newtab override enables search monetization.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; primary surface for ad/affiliate monetization.

Pillar Scores

Bookkeeping