Top Risks

• Uninstall URL hijack to yowgames.com with UTM tracking — classic monetization shell fingerprint.
• Install URL hijack to yowgames.com — redirects user on install for ad/affiliate credit.
• Privacy policy fetched but NOT scoped to this extension; admits data collection and third-party sharing (+10 privacy).
• Free-webmail developer (gmail) with no verified publisher; policy domain yowgames.com is unrelated to stated developer identity.
• Content script runs on *://*/*ー broad page reach despite minimal declared permissions.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → yowgames.com with UTM params; classic traffic-monetization pattern.
• install_url_hijack manifest onInstalled opens yowgames.com UTM URL; affiliate/ad credit on every install.
• privacy_policy_not_scoped api Policy at yowgames.com: scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email ayseozkacar237@gmail.com; not a verified publisher; no business domain.
• content_scripts_broad manifest content_scripts_matches=[*://*/*] — injects into every HTTP/HTTPS page.
• external_host_yowgames crx js_external_hosts includes yowgames.com; extension contacts third-party game-portal domain.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• maintenance_3_6mo store months_since_update=9; falls in 6-12 month stale band (+3.5).

Permissions Breakdown

• storage low Stores cursor preferences locally; low abuse potential on its own.
• content_scripts *://*/* medium Runs on every page; broad reach even without explicit host_permissions grant.

Pillar Scores

Bookkeeping