Top Risks

• Uninstall and install URL both hijacked to gameograf.com affiliate tracker — explicit monetization shell.
• New-tab override replaces every new tab; search permission enables search-provider manipulation.
• Privacy policy is Google's own generic policy — not scoped to this extension, admits data collection + 3rd-party sharing.
• Free-webmail dev (tamyssabillys@gmail.com) with no business domain; 18 installs with new-tab+search override is tail-attack-surface.
• External JS hosts include social/streaming platforms (instagram, netflix, youtube, x.com) inconsistent with a wallpaper extension.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → gameograf.com with ovkas UTM params; classic monetization shell.
• install_url_hijack manifest onInstalled opens gameograf.com with same UTM params; double hijack pattern.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new-tab for search monetization.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, scope_extension=false, data_collection+3rd_party_sharing=true.
• free_webmail_dev store Developer email tamyssabillys@gmail.com; no business domain; no verified publisher badge.
• js_external_hosts_mismatch crx Wallpaper extension contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — inconsistent with stated function.
• no_csp manifest content_security_policy is null on MV3 extension; v2 calibration +2.0 network not applied (MV3 has strict default).
• new_tab_with_search_engine_1 crx search_engine_count=1 (google.com); single-engine NewTab — not multi-engine aggregator, but monetization pattern confirmed via hijacks.

Permissions Breakdown

• search medium Allows reading/modifying search queries; paired with newtab override it enables search-provider manipulation.
• chrome_url_overrides.newtab medium Replaces every new tab with extension-controlled page; core monetization vector for this shell pattern.

Pillar Scores

Bookkeeping