Top Risks

• Uninstall and install URL both hijack to gameograf.com with UTM tracking — confirmed monetization shell.
• NewTab override replaces every new-tab with extension page, capturing all search traffic.
• Privacy policy is Google's generic account policy — not scoped to this extension, yet admits data collection and 3rd-party sharing (+10.0).
• Free-webmail dev (gmail), no developer name, no business website — unverifiable identity.
• JS external hosts include gameograf.com, Instagram, Netflix, YouTube, X — far beyond stated wallpaper function.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → gameograf.com with UTM params; confirmed monetization redirect.
• install_url_hijack manifest onInstalled opens gameograf.com with UTM params; affiliate/monetization shell pattern.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces all new-tab pages with extension content.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google account policy, not extension-scoped; data_collection+3rd_party_sharing=true.
• developer_identity store Developer name empty, email halilseker3455@gmail.com (free webmail). No business domain verifiable.
• js_external_hosts crx Extension contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — far beyond wallpaper scope.
• verified_publisher store Marked verified_publisher=true but monetization hits (gameograf hijacks) cap discount to -1.0 per v3.5 invariant 0c/E.
• new_tab_monetization manifest NewTab override + search permission + gameograf UTM hijacks = classic traffic-monetization pattern.

Permissions Breakdown

• search medium Allows interaction with Chrome search; combined with newtab override enables search-provider capture.
• chrome_url_overrides.newtab high Replaces every new-tab page with extension-controlled HTML; primary monetization surface.

Pillar Scores

Bookkeeping