Top Risks

• Uninstall and install URL both hijacked to gameograf.com (UTM tracking) — aggressive monetization shell.
• New-tab override gives extension control of every new tab session.
• Privacy policy is Google's generic global policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Developer name absent; zero ratings; low installs — minimal accountability.
• 6 external JS hosts including social/streaming platforms far beyond wallpaper stated function.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → gameograf.com with UTM params — traffic monetization on uninstall.
• install_url_hijack manifest onInstalled opens gameograf.com with UTM params — opens 3rd-party page on install.
• newtab_override manifest chrome_url_overrides.newtab=index.html replaces every new tab in browser.
• generic_privacy_policy store Privacy URL is Google's global policy (myaccount.google.com/privacypolicy); not scoped to extension; admits data+3rd-party sharing.
• no_developer_name store developer_name is empty string; accountability gap.
• js_external_hosts crx Extension contacts gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com — 6 distinct hosts across unrelated origins.
• newtab_monetization_shape store NewTab override + install/uninstall hijack to gameograf.com = monetization shell pattern.
• verified_publisher_discount_limited api verified_publisher=true but privacy policy is not scoped; discount capped given monetization redirect signals.

Permissions Breakdown

• search medium Allows manipulation of the browser search provider; medium scope.
• chrome_url_overrides.newtab high Replaces every new tab with extension page — high reach, monetization vector.

Pillar Scores

Bookkeeping