Top Risks

• Uninstall and install URL both hijack to gameograf.com with UTM tracking — confirmed monetization shell.
• Privacy policy is Google's generic account policy (scope_extension=false, data_collection=true, third_party_sharing=true) — +10 privacy score.
• NewTab override + search permission combo enables ad-monetization on every new tab without user consent.
• Free-webmail developer (gmail) with no verified publisher, no business domain, redirecting to game portal.
• 5 sibling extensions share same install/uninstall URL fingerprint (gameograf.com/ovkas), indicating a mass-publisher operation.

Evidence

• install_url_hijack crx onInstalled opens gameograf.com with UTM params (utm_source=ovkas) — monetization shell confirmed.
• uninstall_url_hijack crx setUninstallURL points to gameograf.com with UTM params — 3rd-party hijack.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab routed through extension UI.
• generic_privacy_policy store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email ulasaskin728@gmail.com; no business domain; not a verified publisher.
• operator_cluster_install_url api 5 sibling extensions share same install_url fingerprint (gameograf.com/ovkas), indicating bulk publisher.
• js_external_hosts crx Extension contacts gameograf.com plus instagram, netflix, youtube, x.com — broad scope for a wallpaper.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.

Permissions Breakdown

• search medium Allows manipulating the search provider; stacks with newtab override for monetization.
• chrome_url_overrides.newtab medium Replaces the new-tab page, enabling ad/affiliate injection on every new tab open.

Pillar Scores

Bookkeeping