Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Sung Jin-Woo Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall and install URL hijack both redirect to gameograf.com (ad/game portal UTM tracking).
• Privacy policy is generic Google account policy — does not scope to this extension or disclose its data practices.
• New-tab override with 6 external JS hosts (YouTube, Netflix, Instagram, X, Google, gameograf.com) indicates monetisation shell.
• No CSP on MV3 extension that overrides new-tab and contacts multiple social/media platforms.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com with UTM params (ovkas campaign).
• install_url_hijack crx onInstalled opens gameograf.com with same UTM params; classic monetisation redirect.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new-tab for monetisation.
• generic_privacy_policy store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not Ovkas/extension-specific.
• external_js_hosts crx 6 distinct external hosts: gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening declared.
• game_portal_pattern crx gameograf.com domain in both install/uninstall URLs matches game-portal shell monetisation pattern.
• privacy_policy_classification api fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy score.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Sung Jin-Woo Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.49 -> 7.99 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding search provider behaviour; medium-risk on its own.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary monetisation surface for this extension.

Pillar Scores

Bookkeeping