Top Risks

• Uninstall and install URL hijack both redirect to gameograf.com — classic monetization shell pattern.
• Privacy policy is Google's own policy, not scoped to this extension; admits data collection and 3rd-party sharing.
• NewTab override + search permission hijacks every new tab for all users — high-reach monetization surface.
• JS contacts Netflix, Instagram, YouTube, X.com, gameograf.com from a wallpaper extension — scope mismatch.
• No CSP on MV3 extension with external host access across 6 domains including ad-tier gameograf.com.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL targets gameograf.com with UTM tracking params — monetization shell.
• install_url_hijack manifest onInstalled opens gameograf.com with UTM params — install redirect to 3rd-party.
• newtab_override manifest chrome_url_overrides.newtab replaces every new tab; wallpaper framing disguises search monetization.
• external_hosts_scope_mismatch crx JS contacts gameograf.com, instagram.com, netflix.com, x.com — unrelated to a wallpaper extension.
• privacy_policy_generic store Policy URL is Google's own policy (myaccount.google.com); scope_extension=false, data_collection=true, 3rd_party=true.
• no_csp crx content_security_policy is null; no CSP protection despite 6 external JS hosts.
• search_permission_newtab_combo manifest search permission + newtab override = full search-monetization stack under wallpaper branding.
• domain_age api ovkas.com first cert 2023-09-24, age ~1086 days; not new but no verified publisher status.

Permissions Breakdown

• search medium Allows overriding search provider; pairs with newtab override to control user search.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; monetization/tracking surface for all users.

Pillar Scores

Bookkeeping