Top Risks

• Uninstall AND install URL hijack both redirect to gameograf.com with UTM tracking — confirmed monetization shell.
• Privacy policy is Google's generic account policy (scope_extension=false, admits data collection & 3rd-party sharing) → scored +10.
• NewTab override combined with search permission replaces user's new tab for ad/affiliate monetization.
• Free-webmail developer (gmail), no verified publisher, no business domain — unverifiable identity.
• Extension contacts gameograf.com, instagram, netflix, youtube, x.com from JS — broad external reach from a 4-install wallpaper.

Evidence

• uninstall_url_hijack manifest Redirects to gameograf.com with utm_source=ovkas on uninstall — explicit monetization tracking.
• install_url_hijack manifest Redirects to gameograf.com with utm_source=ovkas on install — dual hijack pattern.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab controlled by extension.
• generic_privacy_policy store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension.
• privacy_classification_admits_sharing api scope_extension=false, data_collection=true, third_party_sharing=true — worst-case generic policy (v3.5 D → +10).
• free_webmail_developer store Developer email fatihkaran600@gmail.com; no business website or verified publisher status.
• js_external_hosts crx JS contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — 6 external hosts, 2 countries.
• new_tab_monetization_shape manifest NewTab + search permission + install/uninstall hijack + external game portal = classic traffic-monetization shell.

Permissions Breakdown

• search medium Search API allows override of default search behavior; medium risk especially alongside newtab override.
• chrome_url_overrides.newtab medium Replaces every new tab with extension-controlled page; prime surface for ad monetization and tracking.

Pillar Scores

Bookkeeping