Top Risks

• Uninstall AND install URL hijacked to gameograf.com — classic traffic-monetization shell pattern.
• NewTab override + search permission: every new tab is controlled by this extension for ad/search revenue.
• Privacy policy is generic Google account policy — not scoped to this extension, admits data collection & 3rd-party sharing.
• Free-webmail dev (gmail) with no verified business identity; dev domain resolves to game portal.
• JS contacts gameograf.com, Instagram, Netflix, YouTube, X — far beyond stated wallpaper function.

Evidence

• install_url_hijack manifest onInstalled opens https://gameograf.com/?utm_source=ovkas — classic monetization shell install hijack.
• uninstall_url_hijack manifest setUninstallURL points to https://gameograf.com/?utm_source=ovkas — 3rd-party traffic capture on uninstall.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab controlled by extension.
• js_external_hosts_broad crx JS contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — unrelated to wallpaper function.
• privacy_policy_generic store Policy is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true) — +10 privacy.
• free_webmail_dev store Developer email willcansmithci@gmail.com; no verified business; reputation floor 7.5.
• game_portal_shell crx gameograf.com is a game portal used as install/uninstall target — game-portal shell pattern confirmed.
• search_permission_newtab_combo manifest search permission + newtab override = search monetization capability without broad host_permissions.

Permissions Breakdown

• search medium Allows search provider manipulation; combined with newtab override raises monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab page — primary attack surface for ad/search monetization.

Pillar Scores

Bookkeeping