Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Stitch Sky Explorer Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall & install URL hijack both redirect to gameograf.com affiliate/monetization portal.
• NewTab override replaces every new tab with extension-controlled page for ad monetization.
• Privacy policy URL returns fetch error — no policy effectively in force.
• Free-webmail dev (gmail), no developer name, no verified business domain.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → https://gameograf.com/?utm_source=ovkas… (affiliate monetization).
• install_url_hijack manifest onInstalled opens https://gameograf.com/?utm_source=ovkas… on every install.
• newtab_override manifest chrome_url_overrides.newtab = index.html; new-tab monetization pattern confirmed.
• privacy_policy_fetch_error api privacy_policy_classification.fetched==false (HTTPError); no effective policy.
• free_webmail_no_devname store Developer email halilseker3455@gmail.com; developer_name empty; no verified business.
• external_js_hosts crx JS contacts 7 external hosts incl. gameograf.com, games.ovkas.com, instagram.com, netflix.com.
• search_override manifest Permission 'search' declared alongside newtab override — search monetization shape.
• verified_publisher store verified_publisher=true but paired with gmail dev, no dev name, and hijack URLs.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Stitch Sky Explorer Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 6.06 -> 8.56 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding search provider; paired with newtab override creates monetization surface.
• chrome_url_overrides.newtab high Replaces new-tab page; primary vector for ad/monetization injection via gameograf.com.

Pillar Scores

Bookkeeping