Top Risks

• Uninstall & install URL both hijack to gameograf.com with UTM tracking — classic monetization shell.
• Google generic privacy policy (scope_extension=false, admits data collection & 3rd-party sharing) — scores max privacy risk.
• NewTab override + search permission = full search-hijack capability in a fan-art wrapper.
• Free-webmail gmail dev with no verified publisher, no business domain — unaccountable operator.
• JS contacts gameograf.com, instagram, netflix, youtube, x.com — broad unrelated external host reach for a wallpaper.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com with UTM tracking params (ovkas campaign).
• install_url_hijack crx onInstalled opens gameograf.com with same UTM params — monetization on every install.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab captured by extension.
• generic_privacy_policy store Policy URL is Google account policy — scope_extension=false, admits data_collection+3rd_party_sharing.
• free_webmail_dev store Developer email birolkaya63536@gmail.com — gmail, no verified publisher, no business domain.
• broad_js_external_hosts crx Extension JS contacts gameograf.com, instagram, netflix, youtube, x.com — unrelated to wallpaper function.
• search_permission_newtab manifest search permission + newtab override together enable full search-engine replacement.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening declared.

Permissions Breakdown

• search medium Allows overriding search provider; combined with newtab override this is a search-hijack surface.
• chrome_url_overrides.newtab medium Replaces every new tab with extension page; monetization vector for NewTab shells.

Pillar Scores

Bookkeeping