Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Sanrio Hello Kitty on the Beach Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall & install URL hijack both redirect to gameograf.com with UTM tracking — monetization shell pattern confirmed.
• Privacy policy is Google's generic policy (scope_extension=false, data_collection=true, third_party_sharing=true) — worst-case privacy scoring.
• NewTab override + 'search' permission replaces every new tab and can steer search traffic for monetization.
• JS contacts gameograf.com plus major social/media sites (Instagram, Netflix, YouTube, X) — unusual reach for a wallpaper.

Evidence

• install_url_hijack manifest onInstalled opens gameograf.com with UTM params utm_source/medium/campaign/content=ovkas — clear monetization redirect.
• uninstall_url_hijack manifest setUninstallURL targets gameograf.com with identical UTM tracking — game-portal shell pattern.
• newtab_override manifest chrome_url_overrides.newtab set to index.html; every new tab replaced by this extension.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension at all.
• js_external_hosts_broad crx gameograf.com, instagram.com, netflix.com, youtube.com, x.com listed as JS external hosts — excessive for a wallpaper.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.
• search_permission_newtab_combo manifest 'search' permission + newtab override enables full search-provider monetization surface.
• privacy_data_collection_admitted api Classification: fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true — D v3.5 rule triggers +10.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Sanrio Hello Kitty on the Beach Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.27 -> 7.77 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding search provider; medium-risk on its own but paired with newtab override raises monetization concern.
• chrome_url_overrides.newtab medium Replaces every new-tab page; primary vector for ad/affiliate monetization in this extension.

Pillar Scores

Bookkeeping