Top Risks

• Uninstall and install URL both hijack to gameograf.com with UTM tracking — clear monetization shell pattern.
• NewTab override replaces every new tab; combined with 'search' permission enables full search monetization.
• Privacy policy is Google's generic account policy — does not scope to this extension at all (data_collection+third_party_sharing admitted without scoping).
• Free-webmail developer (gmail), no verified publisher, no business website; accountability near zero.
• External JS hosts include instagram.com, netflix.com, youtube.com, x.com — no justification for wallpaper extension contacting these.

Evidence

• install_and_uninstall_url_hijack crx Both onInstalled and uninstall URLs point to gameograf.com with UTM campaign tags — monetization shell pattern.
• newtab_override manifest chrome_url_overrides.newtab set to index.html; every new tab controlled by extension.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — not scoped to this extension; admits data_collection+third_party_sharing.
• free_webmail_developer store Developer email halilseker3455@gmail.com — numbered-alias pattern, no verified business domain.
• external_hosts_mismatch crx JS contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — unexplained for a wallpaper extension.
• no_csp manifest content_security_policy is null; no script-src restriction on MV3 extension.
• search_permission_plus_newtab manifest 'search' permission + newtab override is standard search-monetization fingerprint.
• numbered_alias_email store Email halilseker3455@gmail.com matches numbered-alias dev pattern (+3.0 webstore rule).

Permissions Breakdown

• search medium Allows reading/modifying search queries; combined with NewTab override amplifies search monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab with extension-controlled page; classic monetization/tracking surface.

Pillar Scores

Bookkeeping