Top Risks

• Uninstall and install URL both hijack to gameograf.com — classic monetization shell pattern.
• New-tab override with 'search' permission and external JS hosts (Google, Instagram, Netflix, YouTube, X) signals ad/tracking aggregator.
• Privacy policy is generic Google account policy — not scoped to this extension at all; admits data collection and 3rd-party sharing.
• Free-webmail developer (gmail), no developer name, verified_publisher flag does not override monetization indicators.
• Extension contacts 6 external JS hosts including major platforms from a wallpaper/NewTab; purpose mismatch.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL targets gameograf.com with UTM tracking params — monetization shell indicator.
• install_url_hijack manifest onInstalled opens gameograf.com with UTM params — traffic monetization on install.
• newtab_override manifest chrome_url_overrides.newtab = index.html replaces every new-tab page for all users.
• external_js_hosts crx JS contacts gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com — 6 distinct domains.
• privacy_policy_generic store Policy is Google's own account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• developer_identity store Free Gmail dev, no developer_name field, no business domain — accountability gap.
• verified_publisher_with_monetization store verified_publisher=true but monetization shell pattern present; v3.5 caps discount to -1.0.
• search_permission_newtab_combo manifest 'search' permission + newtab override enables search provider monetization without explicit search_override declaration.

Permissions Breakdown

• search medium Can override or read search settings; paired with newtab override amplifies search monetization risk.
• chrome_url_overrides.newtab high Replaces every new-tab page; prime surface for ad injection, search hijacking, and tracking.

Pillar Scores

Bookkeeping