Top Risks

• Uninstall and install URL hijack both redirect to gameograf.com — classic traffic-monetization shell pattern.
• New-tab override combined with 'search' permission enables persistent search/traffic diversion for every new tab.
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing (+10.0 privacy).
• Free-webmail dev (gmail), no developer name, no business domain — unverifiable operator identity.
• External JS hosts include social/streaming giants (Instagram, Netflix, YouTube, X) from a wallpaper extension — scope far exceeds stated function.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com with UTM campaign params; clear monetization redirect.
• install_url_hijack crx onInstalled opens gameograf.com with same UTM params; double hijack confirms monetization shell.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab captured for wallpaper/monetization.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension at all.
• dev_identity store Developer email halilseker3455@gmail.com, no developer name, no business domain — unverifiable.
• js_external_hosts_scope_mismatch crx wallpaper extension contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — far beyond stated function.
• verified_publisher store verified_publisher=true but no business domain; discount capped due to monetization signal (v3.5 invariant 0c/E).
• privacy_policy_classification api fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (v3.5 rule D).

Permissions Breakdown

• search medium Allows overriding search provider; medium risk on its own but combined with newtab override raises concern.
• chrome_url_overrides.newtab high Replaces new-tab page; primary mechanism for traffic-monetization shells. Scored under v2 calibration fix (a).

Pillar Scores

Bookkeeping