Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — One Piece Horizon Stormbringer Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall AND install URL both hijack to gameograf.com UTM — confirmed monetization shell pattern.
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection & 3rd-party sharing (+10.0).
• NewTab override combined with 'search' permission replaces every new tab for ad-revenue capture.
• Free-webmail developer (gmail) with no verifiable business identity; gameograf.com UTM fingerprint suggests repeat operator.

Evidence

• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=ovkas — confirmed monetization redirect on install.
• uninstall_url_hijack crx setUninstallURL points to https://gameograf.com/?utm_source=ovkas — 3rd-party uninstall tracking confirmed.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab page.
• privacy_policy_generic store Policy URL is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true).
• free_webmail_developer store Developer email tamyssabillys@gmail.com; no verified business; domain_age_ct not queried (free webmail).
• js_external_hosts crx Extension contacts gameograf.com + 5 major platform domains (google, instagram, netflix, youtube, x.com).
• webstore_newtab_monetization store NewTab + install/uninstall hijack to gameograf.com matches game-portal shell / new-tab monetization pattern.
• no_ratings store 154 installs, 0 ratings — insufficient trust signal to offset monetization indicators.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — One Piece Horizon Stormbringer Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 6.36 -> 8.86 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding search provider; medium risk on its own, elevated by newtab override.
• chrome_url_overrides.newtab high Replaces every new tab — prime monetization surface; paired with uninstall/install URL hijacks.

Pillar Scores

Bookkeeping