Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Ghostface Scream Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall and install URL hijacks redirect users to chromewallpaper.com — classic traffic monetization shell.
• NewTab override + search permission combines to create persistent search-hijack/monetization surface on every new tab.
• Privacy policy is Google's generic policy (scope_extension=false, admits 3rd-party sharing) — maps to +10.0 Privacy under v3.5 rule D.
• Developer uses free webmail (gmail) with no verified publisher status and no resolvable business domain.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL points to chromewallpaper.com — Webstore +3.0 traffic-monetization signal.
• install_url_hijack crx onInstalled opens chromewallpaper.com/ghostface-scream-live-wallpaper/ — Webstore +2.0.
• newtab_override manifest chrome_url_overrides.newtab=index.html replaces every new tab; combined with 'search' permission.
• generic_privacy_policy store Policy URL is Google's own privacy page; scope_extension=false, data_collection=true, third_party_sharing=true → Privacy +10.0.
• free_webmail_developer store Developer email gokcey638@gmail.com; no verified publisher; no business domain → Reputation floor 7.5.
• js_external_hosts crx 9 external hosts including owhit.com, chromewallpaper.com, instagram, netflix, youtube — far beyond wallpaper scope.
• maintenance_stale store 14 months since update → Maintenance +6.0 (6-12mo band).
• no_csp manifest content_security_policy is null/absent on MV3; no CSP amplification applies (MV3 strict default), but noted.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Ghostface Scream Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 6.46 -> 8.96 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Enables search-provider interaction; combined with newtab override creates monetizable search hijack surface.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; high-reach monetization vector.

Pillar Scores

Bookkeeping