Top Risks

• Uninstall URL hijack redirects to gameograf.com ad/affiliate page with UTM tracking.
• Install URL hijack also redirects to gameograf.com on installation.
• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• Free-webmail dev (gmail) with no verified business identity; numbered-alias email pattern.
• NewTab override + search permission combo enables search monetization without broad host access.

Evidence

• uninstall_url_hijack manifest Uninstall redirects to gameograf.com with UTM ovkas campaign params — clear monetization intent.
• install_url_hijack manifest Install event also redirects to gameograf.com with identical UTM params.
• newtab_override manifest chrome_url_overrides.newtab = index.html; hijacks every new tab for wallpaper/ad display.
• privacy_policy_generic store Policy is Google's own account policy — scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_dev store Developer email gayeatakul4@gmail.com — free webmail, no verified business, numbered alias pattern.
• external_hosts crx JS contacts gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com — 6 external hosts.
• no_verified_publisher store No verified publisher badge, no featured badge, 41 installs, 0 ratings.
• no_csp manifest content_security_policy is null — MV3 default applies but no explicit CSP declared.

Permissions Breakdown

• search medium Can intercept/override search queries; low alone but combined with newtab override raises risk.
• chrome_url_overrides.newtab medium Replaces new tab page; primary surface for ad-monetization and search hijacking.

Pillar Scores

Bookkeeping