Top Risks

• Uninstall and install URL both hijack to gameograf.com with UTM tracking — confirmed monetization shell.
• Privacy policy is generic Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true) — scores as +10.
• NewTab override replaces every new tab; combined with 'search' permission and gameograf.com hooks creates persistent ad-monetization surface.
• Free-webmail developer (gmail.com), no verified publisher, no business domain — elevated identity risk.
• JS contacts gameograf.com, Google, Instagram, Netflix, YouTube, X.com — broad external reach beyond stated wallpaper function.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → gameograf.com with utm_source=ovkas; confirmed 3rd-party redirect on uninstall.
• install_url_hijack manifest onInstalled opens gameograf.com with utm tracking params; install-time traffic monetization confirmed.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab captured by extension.
• generic_privacy_policy store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email halilseker3455@gmail.com; no verified publisher, no business website, numbered alias pattern.
• js_external_hosts crx Extension JS contacts gameograf.com + 5 major platforms (Google, Instagram, Netflix, YouTube, X) — scope mismatch for wallpaper.
• search_permission_newtab_combo manifest 'search' permission + newtab override = potential search hijack surface beyond stated wallpaper function.
• new_tab_monetization_pattern store NewTab + install/uninstall URL hijacks to gameograf.com UTM links = classic traffic-monetization shell.

Permissions Breakdown

• search medium Allows overriding search provider; medium risk on its own but paired with newtab override is concerning.
• chrome_url_overrides.newtab high Replaces every new tab with extension page — primary monetization vector for this category.

Pillar Scores

Bookkeeping