Top Risks

• Uninstall AND install URL hijack to gameograf.com — confirmed monetization/tracking shell pattern.
• NewTab override funnels every new tab through extension; operator cluster has 13 siblings on same install/uninstall URL.
• Privacy policy is Google's generic policy — scope_extension false, data_collection and 3rd-party sharing admitted without extension scope.
• Free-webmail dev (gmail), no developer name, verified_publisher badge but fingerprint is a known traffic-monetization cluster.
• JS external hosts include instagram.com, netflix.com, youtube.com, x.com — scope far exceeds stated wallpaper function.

Evidence

• install+uninstall URL hijack manifest Both onInstalled and uninstall redirect to gameograf.com with UTM tracking params — classic monetization shell.
• newtab override manifest chrome_url_overrides.newtab = index.html; every new tab is controlled by this extension.
• operator cluster api sibling_count=3 compound; 13 siblings share same install/uninstall URL — mass-produced NewTab monetization cluster.
• generic Google privacy policy store Privacy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true.
• js_external_hosts scope mismatch crx Extension contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — far beyond a wallpaper function.
• free-webmail dev, no developer name store halilseker3455@gmail.com with no developer_name field; numbered-alias pattern raises reputation concern.
• verified_publisher claimed store verified_publisher=true but domain is gmail.com and monetization hits exist; v3.5-E caps discount to -1.0.
• search permission + NewTab manifest search permission combined with newtab override enables full search-monetization pipeline.

Permissions Breakdown

• search medium Allows querying the browser's search API; medium risk on its own but combined with newtab override raises concern.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; core monetization surface for NewTab shells.

Pillar Scores

Operator Siblings (3)

Other extensions sharing this developer's compound fingerprint:

• pnnajndbaillimdgjfafambpcddaomfj
• giiedinejlhaaeibpbbjfdfhbieidffb
• alojjfbglkmeedlcicmjkjlbaloljjjh

Bookkeeping