Top Risks

• NewTab override + uninstall/install URL hijacks redirect to gameograf.com — classic monetization shell.
• Privacy policy is Google's generic policy (scope_extension=false, admits data+3rd-party sharing) → +10.0 privacy per v3.5-D.
• Free-webmail Gmail dev (gizemoge752@gmail.com), no verified publisher, no business domain — high reputation risk.
• JS contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — 5 unrelated external hosts for a wallpaper extension.
• Search override + NewTab override together enable search-traffic monetization without disclosure.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → gameograf.com with UTM tracking; classic monetization shell pattern.
• install_url_hijack manifest onInstalled opens gameograf.com with UTM tracking — install hijack confirmed.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab replaced by extension.
• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email gizemoge752@gmail.com; no verified publisher, no business domain.
• external_hosts_unrelated crx JS contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — unrelated to wallpaper function.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP hardening.
• low_install_monetization_pattern store Only 294 installs; uninstall+install URL hijacks to gameograf.com indicate monetization-shell deployment.

Permissions Breakdown

• search medium Allows querying browser search; paired with NewTab override amplifies search monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab; primary vector for ad/search monetization and traffic hijacking.

Pillar Scores

Bookkeeping