Top Risks

• Uninstall and install URL both hijacked to gameograf.com affiliate tracker — classic monetization shell pattern.
• NewTab override replaces every new tab with developer-controlled page; 'search' permission enables search provider override.
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and third-party sharing (+10.0).
• Free-webmail developer (gmail) with no verified business presence; extension targets gameograf.com with full UTM affiliate parameters.
• Contacts 6 external JS hosts (gameograf.com, Instagram, Netflix, YouTube, X, Google) far beyond stated wallpaper function.

Evidence

• uninstall_url_hijack manifest setUninstallURL → gameograf.com with full ovkas UTM params; monetization shell fingerprint.
• install_url_hijack manifest onInstalled opens gameograf.com with ovkas UTM campaign; affiliate redirect on install.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab for monetization.
• privacy_policy_generic store Policy is Google account-level; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0.
• free_webmail_dev store Developer email yakupsaylan357@gmail.com; no business domain; reputation floor 7.5.
• js_external_hosts_mismatch crx 6 external hosts including gameograf.com, Instagram, Netflix, YouTube, X — far beyond wallpaper scope.
• new_tab_override_monetization manifest NewTab + search permission + affiliate hijack URLs = full monetization cluster.
• csp_absent manifest content_security_policy is null; MV3 default applies but no explicit restriction declared.

Permissions Breakdown

• search medium Allows manipulation of search provider; paired with newtab override creates full search-monetization surface.
• chrome_url_overrides.newtab high Replaces every new tab; primary mechanism for ad/search monetization in shell extensions.

Pillar Scores

Bookkeeping