Top Risks

• Uninstall + install URL both hijack to gameograf.com — classic monetization shell pattern.
• New-tab override with 'search' permission and game-portal redirect is a traffic-monetization fingerprint.
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Free-webmail developer (gmail) with no verified business; manifest name/description are i18n placeholders hiding real intent.
• Extension contacts 6 external JS hosts (gameograf, Instagram, Netflix, YouTube, X, Google) from a wallpaper extension — severe scope mismatch.

Evidence

• install_url_hijack crx onInstalled opens gameograf.com with utm_source=ovkas — game-portal traffic monetization on every install.
• uninstall_url_hijack crx setUninstallURL points to same gameograf.com UTM target — confirmed monetization shell.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab captured and monetized.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension; data_collection+3rd_party_sharing=true.
• free_webmail_developer store Developer email halilseker3455@gmail.com; numbered alias pattern; no business domain.
• external_js_hosts_mismatch crx 6 external JS hosts including instagram.com, netflix.com, youtube.com, x.com — unrelated to a wallpaper extension.
• manifest_i18n_placeholders manifest manifest_name and manifest_description are __MSG__ placeholders — actual content hidden from store scraping.
• new_tab_monetization_pattern store Game-portal shell: newtab override + search permission + UTM-tagged install/uninstall URLs all point to gameograf.com.

Permissions Breakdown

• search medium Allows reading/manipulating search queries; medium risk on its own but paired with newtab override is suspicious.
• chrome_url_overrides.newtab medium Replaces every new tab; primary monetization vector for this shell pattern.

Pillar Scores

Bookkeeping