Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — GTA VI Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall AND install URL both hijack to gameograf.com with UTM tracking — confirmed traffic-monetization shell.
• Privacy policy is Google's own policy, not scoped to this extension; admits data collection and 3rd-party sharing.
• NewTab override with 'search' permission and 7 external JS hosts including social/streaming platforms.
• Free-webmail developer (gmail), no verified publisher, no business website — unaccountable operator.

Evidence

• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=ovkas — confirmed monetization redirect.
• uninstall_url_hijack crx setUninstallURL points to https://gameograf.com/?utm_source=ovkas — traffic exfil on removal.
• privacy_policy_generic store Policy URL is Google account policy: scope_extension=false, data_collection=true, third_party_sharing=true.
• newtab_override manifest chrome_url_overrides.newtab = index.html; combined with search permission = classic NewTab monetization shell.
• external_hosts crx JS contacts 7 hosts: gameograf.com, games.ovkas.com, google, instagram, netflix, youtube, x.com.
• operator_cluster_siblings api 14 other extensions share same install/uninstall URL fingerprint under halilseker3455@gmail.com.
• free_webmail_developer store Developer email gmail.com, no verified publisher, no business website — unaccountable identity.
• csp_absent manifest content_security_policy is null; MV3 default applies but no explicit CSP declared.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — GTA VI Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.47 -> 7.97 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding search provider; combined with newtab override creates monetization surface.
• chrome_url_overrides.newtab medium Replaces every new tab with extension page — primary delivery mechanism for traffic monetization.

Pillar Scores

Bookkeeping