Top Risks

• Hard uninstall+install URL hijack to gameograf.com ad-tech funnel — confirmed monetization shell pattern.
• Privacy policy fetch failed; no data-handling disclosure available — treated as no policy.
• NewTab override + search permission combo enables persistent search/traffic monetization on every new tab.
• JS contacts major platforms (Netflix, Instagram, YouTube, X) plus ad-domain gameograf.com — anomalous for a wallpaper.
• Free-webmail dev (gmail), no developer name, no verified business website — unaccountable publisher.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com with ovkas UTM params; classic monetization shell.
• install_url_hijack crx onInstalled opens gameograf.com with ovkas UTM params; confirms traffic-monetization intent.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab hijacked to extension page.
• js_external_hosts_anomalous crx gameograf.com, games.ovkas.com contacted alongside Netflix, Instagram, YouTube, X — unrelated to wallpaper.
• privacy_policy_fetch_failed api ovkas.com/privacy-policy returned HTTPError; policy classified as not fetched → +10 privacy pillar.
• free_webmail_no_dev_name store Developer email halilseker3455@gmail.com; developer_name empty; no verified business presence.
• verified_publisher store verified_publisher=true but monetization hits present — invariant 0c/0E caps discount to -1.0.
• newtab_monetization_webstore_flags manifest NewTab+search override+uninstall hijack+install hijack = full monetization-shell fingerprint.

Permissions Breakdown

• search medium Allows reading/overriding search provider; medium risk in isolation but paired with newtab override raises concern.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary vector for search hijacking and ad monetization.

Pillar Scores

Bookkeeping