Top Risks

• Uninstall & install URL hijack both redirect to gameograf.com ad-traffic platform — classic monetization shell.
• NewTab override combined with 'search' permission creates full search-monetization capability on every browser session.
• Privacy policy is Google's own generic policy — not scoped to this extension, admits data collection and 3rd-party sharing: scores maximum privacy risk.
• Free-webmail developer (gmail) with no verified publisher, no business domain, no rating — unverifiable identity.
• External JS hosts include gameograf.com, instagram.com, netflix.com, youtube.com — broad reach beyond stated wallpaper function.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com with UTM campaign 'ovkas'; clear traffic-monetization redirect.
• install_url_hijack crx onInstalled opens gameograf.com with same UTM params; double URL hijack pattern.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab controlled by extension.
• generic_privacy_policy store Privacy policy is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension at all.
• free_webmail_dev store Developer email willcansmithci@gmail.com; no verified publisher, no business domain, unverifiable identity.
• js_external_hosts crx Extension loads/contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — far beyond wallpaper scope.
• game_portal_shell crx gameograf.com is a game-portal/ad-traffic domain used for both install and uninstall redirect monetization.
• new_tab_monetization_override manifest NewTab override + search permission + gameograf hijacks = textbook new-tab monetization shell pattern.

Permissions Breakdown

• search medium Allows search provider interaction; combined with newtab override amplifies monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab with extension-controlled page; core monetization/tracking surface.

Pillar Scores

Bookkeeping