Top Risks

• Uninstall and install URL hijack both redirect to gameograf.com — classic monetization shell pattern.
• Minecraft brand impersonation by unverified free-webmail developer with no confirmed ownership.
• New-tab override with 'search' permission = search-monetization architecture baked in.
• Privacy policy is generic Google Account policy — does not scope to this extension at all.
• External JS hosts include instagram, netflix, youtube, x.com — far beyond stated wallpaper function.

Evidence

• install_url_hijack + uninstall_url_hijack manifest Both onInstalled and uninstall redirect to gameograf.com with utm_source=ovkas — textbook monetization shell.
• brand_impersonation store Minecraft brand mentioned; developer gmail.com, confirmed_owner=false, is_impersonation=true.
• newtab_override manifest chrome_url_overrides.newtab = index.html; combined with search permission enables ad-search monetization.
• privacy_policy_generic store Policy URL is Google Account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• js_external_hosts_mismatch crx Extension contacts gameograf.com, instagram, netflix, youtube, x.com — unrelated to a wallpaper function.
• free_webmail_developer store Developer email halilseker3455@gmail.com, no verified publisher, no business domain.
• game_portal_shell crx gameograf.com as hijack target matches game-portal shell monetization pattern.
• csp_absent_mv3 manifest csp_present=false; no CSP declared, though MV3 provides some default protection.

Permissions Breakdown

• search medium Allows reading search queries; combined with newtab override creates search-monetization surface.
• chrome_url_overrides.newtab high Replaces every new tab with extension-controlled page; core monetization vector.

Pillar Scores

Bookkeeping