Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Pokemon All Characters: Live Wallpaper for Chrome [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall URL hijack redirects to gameograf.com, a third-party game/monetization portal — clear revenue extraction.
• Privacy policy URL times out (fetch_error); effectively no accessible privacy policy for users.
• NewTab override + search permission = full search monetization surface on every new tab.
• Free-webmail dev (gmail), no developer name, no verified business identity — accountability gap.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL targets gameograf.com with UTM params referencing dekuy — monetization redirect confirmed.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab controlled by extension.
• privacy_policy_unreachable api privacy_policy_classification.fetched=false, reason=fetch_error:ReadTimeout; policy inaccessible → +10.0 Privacy.
• free_webmail_no_dev_name store developer_email=gnkircak@gmail.com, developer_name empty — no verifiable business identity.
• external_js_hosts crx 7 external hosts: dekuy.com, gameograf.com, getbootstrap.com, github.com, goo.gl, popper.js.org, charistheo.io.
• install_url_hijack manifest onInstalled opens index.html (internal); low risk but pattern consistent with monetization shell.
• verified_publisher store verified_publisher=true but developer_name blank and privacy policy unreachable; discount capped by 0c conditions.
• new_tab_monetization_shape store Pokemon-theme wallpaper NewTab + search override + uninstall redirect = classic traffic-monetization shell pattern.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Pokemon All Characters: Live Wallpaper for Chrome [adware] + malext.io malicious_extension_sentry; score 5.34 -> 7.84 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding search provider; combined with newtab override creates full search monetization surface.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; primary vector for ad/affiliate monetization and search hijacking.

Pillar Scores

Bookkeeping