Top Risks

• Uninstall AND install URL hijacks redirect to gameograf.com — explicit monetization/tracking on lifecycle events.
• New-tab override with gameograf.com monetization shape; privacy policy is Google's generic policy, not scoped to this extension.
• Free-webmail developer (halilseker3455@gmail.com) with no verified publisher badge or business website.
• Privacy policy admits data collection and third-party sharing but is scoped to Google, not this extension — treated as +10 privacy.
• JS external hosts include major platforms (YouTube, Netflix, Instagram, X) — newtab page reaching out to these indicates traffic/monetization aggregation.

Evidence

• uninstall_url_hijack manifest setUninstallURL targets gameograf.com with UTM params identifying developer 'ovkas'.
• install_url_hijack manifest onInstalled opens gameograf.com with same UTM tracking — dual lifecycle hijack.
• newtab_override manifest chrome_url_overrides.newtab = index.html; monetization shell pattern confirmed.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — not scoped to extension; data_collection+third_party_sharing admitted.
• free_webmail_dev store Developer email halilseker3455@gmail.com; no verified publisher; no business domain.
• js_external_hosts_broad crx Extension contacts gameograf.com, YouTube, Netflix, Instagram, X.com — newtab traffic aggregator pattern.
• new_tab_monetization crx +2.0 new-tab override with monetization shape applied; +3.0 uninstall URL hijack to 3rd party.
• csp_absent_mv3 manifest csp_present=false; MV3 has strict default so no Network v2 +2.0 penalty applied.

Permissions Breakdown

• search medium Can manipulate search provider; medium risk on its own.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary surface for monetization shell pattern.

Pillar Scores

Bookkeeping