Top Risks

• Uninstall and install URL hijack both redirect to gameograf.com — confirmed monetization shell pattern.
• Privacy policy is Google's generic policy (scope_extension=false, data_collection=true, third_party_sharing=true) — maximum privacy risk.
• Free-webmail developer (gmail) with no business domain, no verified publisher status.
• NewTab override + search permission = search-hijack capability routing traffic through gameograf.com.
• JS contacts instagram.com, netflix.com, youtube.com, x.com — wide external reach inconsistent with a wallpaper extension.

Evidence

• install_and_uninstall_url_hijack manifest Both onInstalled and uninstall URLs point to gameograf.com with UTM tracking — confirmed monetization shell.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab controlled by developer.
• privacy_policy_generic_google store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension; data_collection+third_party_sharing=true.
• free_webmail_developer store Developer email oktaybahcivan27@gmail.com; no business domain; not verified publisher.
• js_external_hosts_broad crx Extension contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — inconsistent with wallpaper category.
• search_permission_newtab_combo manifest search permission + newtab override is a classic search-hijack pattern enabling ad-revenue monetization.
• no_csp manifest content_security_policy is null — no CSP protection on MV3 extension.
• game_portal_shell store gameograf.com is a game-portal domain used as install/uninstall redirect target with UTM campaign tags.

Permissions Breakdown

• search medium Can intercept/modify search queries; paired with newtab override amplifies search-hijack risk.
• chrome_url_overrides.newtab medium Replaces every new tab with developer-controlled page; primary vector for traffic monetization.

Pillar Scores

Bookkeeping