Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Kaiju No.8 Epic 4K Ultra HD Monster Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall + install URL hijack to gameograf.com — classic traffic-monetization shell pattern.
• New-tab override with search permission: monetization aggregator shape, not a wallpaper.
• Privacy policy is Google's generic policy — does NOT scope to this extension; admits 3rd-party data sharing.
• Free-webmail dev (gmail) with no verified business identity, numbered alias email pattern.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com with UTM tracking params; classic shell monetization.
• install_url_hijack crx onInstalled opens gameograf.com with UTM params; monetization redirect on every fresh install.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces new tab with gameograf-linked page.
• generic_privacy_policy store Privacy policy is Google's own account policy (myaccount.google.com); not scoped to this extension at all.
• free_webmail_dev store Developer email halilseker3455@gmail.com — numbered alias, no verified business domain.
• js_external_hosts_mismatch crx Contacts gameograf.com, Netflix, Instagram, YouTube, X.com — unrelated to a wallpaper extension.
• search_permission_newtab_combo manifest search + newtab override without broad host perms; monetization-shell pattern for search hijack.
• privacy_policy_admits_third_party api Fetched policy: scope_extension=false, data_collection=true, third_party_sharing=true → worst-case privacy score.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Kaiju No.8 Epic 4K Ultra HD Monster Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.39 -> 7.89 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding search provider; paired with newtab override amplifies monetization risk.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary monetization vector for this shell pattern.

Pillar Scores

Bookkeeping