Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Dragon Ball Goku Food Fight Scene Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall AND install URL hijacked to gameograf.com with UTM tracking params — classic monetization shell.
• NewTab override replaces every new tab; combined with 'search' permission creates ad-monetization surface.
• Privacy policy is Google's own policy (scope_extension=false, data_collection+third_party_sharing=true) — admits collection without scoping to this extension → worst-case privacy score.
• Free-webmail developer (halilseker3455@gmail.com), no verified publisher, no business domain — zero accountability.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → https://gameograf.com/?utm_source=ovkas&utm_medium=ovkas&utm_campaign=ovkas&utm_content=ovkas
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=ovkas with full UTM tracking — third-party monetization redirect.
• newtab_override manifest chrome_url_overrides.newtab = index.html; paired with search permission and external JS hosts.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension. data_collection+3rd_party_sharing=true.
• free_webmail_developer store Developer email halilseker3455@gmail.com; developer_name jemsjons34; no business domain; not verified.
• external_js_hosts crx JS contacts gameograf.com + instagram.com + netflix.com + youtube.com + x.com — 5 unrelated major platforms.
• game_portal_shell crx gameograf.com appears as both hijack target and JS host; pattern matches game-portal shell monetization cluster.
• no_csp manifest content_security_policy is null; MV3 default applies but csp_present=false leaves inline execution ungoverned.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Dragon Ball Goku Food Fight Scene Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 6.05 -> 8.55 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/modifying search queries; medium risk in isolation but paired with newtab override escalates concern.
• chrome_url_overrides.newtab high Replaces every new tab with extension-controlled page; primary monetization/tracking surface for this pattern.

Pillar Scores

Operator Siblings (3)

Other extensions sharing this developer's compound fingerprint:

• giiedinejlhaaeibpbbjfdfhbieidffb
• alojjfbglkmeedlcicmjkjlbaloljjjh
• onflifpnebfbgfjmgebmjolnfgfjhhec

Bookkeeping