Top Risks

• Uninstall AND install URL hijack both redirect to gameograf.com ad-monetization portal — classic traffic-monetization shell.
• NewTab override combined with google/youtube/instagram/netflix/x.com as JS external hosts; wallpaper is a shell for ad traffic.
• Privacy policy is Google's generic account policy — scope_extension=false, data_collection=true, third_party_sharing=true — admits data collection without scoping to this extension.
• Free-webmail developer (gmail) with no business website; no verified publisher; no accountability.
• New-tab override with monetization shape: gameograf.com UTM-tagged install/uninstall hooks indicate commercial intent.

Evidence

• install_url_hijack + uninstall_url_hijack crx Both onInstalled and uninstall URLs point to gameograf.com with UTM campaign tags (ovkas). Classic traffic-monetization pattern.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab controlled by extension. Combined with search permission = monetization surface.
• js_external_hosts crx Extension contacts gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com — 6 hosts across unrelated domains.
• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true. Admits collection without extension scope.
• free_webmail_developer store Developer email willcansmithci@gmail.com; no business domain; no verified publisher badge.
• new_tab_monetization_shape manifest search permission + newtab override + UTM-tagged gameograf.com hooks = textbook new-tab monetization shell pattern.
• no_csp crx content_security_policy is null (csp_present=false). MV3 mitigates eval but remote-host contacts are unrestricted.
• low_install_count store Only 703 installs and 0 rating; tail attack surface with high-impact newtab override and monetization hooks.

Permissions Breakdown

• search medium Allows overriding search provider; medium risk on its own but context of NewTab+gameograf makes it elevated.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; primary monetization surface for ad/affiliate injection.

Pillar Scores

Bookkeeping