Top Risks

• Uninstall and install URL both hijack to gameograf.com affiliate/monetization domain — confirmed traffic redirect.
• Privacy policy is generic Google account policy — not scoped to this extension; admits data collection and third-party sharing.
• New-tab override replaces every new tab page, maximising monetization reach on all users.
• Free-webmail developer (gmail) with no business website; unverified identity behind extension contacting 6 external hosts.
• Extension contacts social/media platforms (Instagram, Netflix, YouTube, X) from new-tab page with no declared content-script scope.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → gameograf.com with utm_source=ovkas; monetization redirect confirmed.
• install_url_hijack manifest onInstalled opens gameograf.com with same UTM params; traffic monetization pattern.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab hijacked to extension page.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email sinanalkan2737@gmail.com; no business domain; no verified publisher badge.
• js_external_hosts crx 6 external hosts: gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com — broad tracking surface.
• no_csp manifest content_security_policy is null (csp_present=false); MV3 default applies but no explicit restriction.
• search_permission_plus_newtab manifest search permission combined with newtab override is a classic low-tier search monetization shell pattern.

Permissions Breakdown

• search medium Allows overriding search provider; combined with newtab override is a monetization vector.
• chrome_url_overrides.newtab high Replaces every new tab; primary surface for ad-monetization shells and traffic hijack.

Pillar Scores

Bookkeeping