Top Risks

• Uninstall URL hijack to gameograf.com — classic monetization/traffic-capture shell pattern.
• Install URL hijack to gameograf.com opens 3rd-party site on install; aggressive monetization signal.
• Privacy policy URL is generic Google account page; fetch failed (SSLError); effectively no scoped policy.
• NewTab override combined with 9 external JS hosts (YouTube, Netflix, Reddit, Instagram, X, ChatGPT, etc.) is anomalous for a wallpaper.
• Operator cluster: 20 extensions share same install URL, 12 share uninstall URL — high-volume shell farm.

Evidence

• uninstall_url_hijack crx setUninstallURL → gameograf.com with UTM params; +3.0 Webstore per rubric.
• install_url_hijack crx onInstalled opens gameograf.com with UTM params; +2.0 Webstore per rubric.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; +2.0 Webstore (newtab with monetization shape).
• operator_cluster api sibling_count=1; install_url shared by 20 extensions, uninstall_url by 12 — shell farm fingerprint.
• privacy_policy_unfetchable store URL is generic Google account policy; fetch failed SSLError; classified as fetched=false → +10.0 Privacy.
• external_js_hosts crx 9 external hosts incl. chatgpt.com, netflix.com, instagram.com, x.com — excessive for a wallpaper extension.
• developer_name_missing store developer_name is empty string; +1.0 Reputation per 'no Offered by' rule.
• verified_publisher store verified_publisher=true BUT monetization hits (gameograf) trigger v3.5-E cap; discount capped at -1.0.

Permissions Breakdown

• search medium Allows reading/modifying search provider; combined with newtab override amplifies risk.
• chrome_url_overrides.newtab high Replaces new-tab page; monetization shell pattern confirmed by gameograf.com hooks.

Pillar Scores

Operator Siblings (1)

Other extensions sharing this developer's compound fingerprint:

• memaakonnagaloagpobnapphnjebchni

Bookkeeping