Top Risks

• Uninstall AND install URL both hijack to gameograf.com affiliate/monetization site — confirmed redirect monetization shell.
• Privacy policy URL returns fetch error (inaccessible); no effective disclosure of data practices.
• NewTab override with free-webmail dev, no developer name, and no verified business domain.
• JS contacts major platforms (Instagram, Netflix, YouTube, X) from a wallpaper NewTab — scope far exceeds stated function.
• Verified publisher discount capped: privacy policy unfetchable and affiliate-style install/uninstall hijack present.

Evidence

• uninstall_url_hijack crx setUninstallURL → gameograf.com with UTM params tied to 'ovkas' campaign.
• install_url_hijack crx onInstalled opens gameograf.com with same ovkas UTM campaign — monetization on install and uninstall.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab is extension-controlled.
• privacy_policy_unfetchable api fetch_error:HTTPError on https://ovkas.com/privacy-policy; no effective privacy disclosure.
• free_webmail_no_dev_name store developer_email=halilseker3455@gmail.com; developer_name empty; no verified business entity.
• js_external_hosts_mismatch crx JS contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — far beyond wallpaper scope.
• verified_publisher_cap_applied store v3.5/0c: verified publisher discount capped at -1.0 due to unfetchable privacy policy domain.
• newtab_monetization_pattern crx Uninstall+install URL hijack to affiliate UTM endpoint matches game-portal/monetization shell pattern.

Permissions Breakdown

• search medium Can override or observe search; concerning combined with newtab override.
• chrome_url_overrides.newtab high Replaces every new tab with extension-controlled page; high monetization abuse potential.

Pillar Scores

Bookkeeping