Top Risks

• Uninstall AND install URL both hijack to gameograf.com — confirmed monetization shell pattern.
• NewTab override replaces browser new tab page; 'search' permission enables search provider hijacking.
• Privacy policy is Google's own policy (scope_extension=false, data_collection=true, third_party_sharing=true) — worse than no policy.
• Free-webmail dev (gmail), no business website, pseudonymous developer name 'jemsjons34' — unverifiable identity.
• JS contacts gameograf.com plus major platforms (instagram, netflix, youtube, x.com) — 6 external hosts from wallpaper extension.

Evidence

• uninstall_url_hijack crx setUninstallURL → gameograf.com with UTM tracking params. Classic monetization shell.
• install_url_hijack crx onInstalled opens gameograf.com with UTM params — double hijack pattern confirmed.
• newtab_override manifest chrome_url_overrides.newtab = index.html; combined with 'search' permission enables full search monetization.
• privacy_policy_generic store Policy URL is Google's account privacy page — scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_dev store Dev email halilseker3455@gmail.com; dev name 'jemsjons34' — no verifiable business identity.
• js_external_hosts crx 6 external hosts: gameograf.com, google, instagram, netflix, youtube, x.com — excessive for a wallpaper.
• game_portal_shell crx gameograf.com domain pattern consistent with game-portal monetization shell.
• new_tab_monetization manifest Anime-theme wallpaper as newtab shell is textbook low-effort traffic-monetization cluster.

Permissions Breakdown

• search medium Allows manipulation of search provider; combined with newtab override, enables search hijacking.
• chrome_url_overrides.newtab high Replaces new tab page — core monetization/hijack vector for this category.

Pillar Scores

Bookkeeping