Top Risks

• Uninstall and install URL both hijacked to gameograf.com — classic traffic-monetization shell pattern.
• New-tab override turns every new tab into a controlled page for affiliate/ad delivery.
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and third-party sharing.
• Free-webmail dev (gmail) with no verifiable business website; developer_domain resolves to gmail.com.
• JS external hosts include gameograf.com alongside major platforms (YouTube, Netflix, Instagram) indicating tracking/redirect scaffolding.

Evidence

• install_url_hijack crx onInstalled opens gameograf.com with UTM params tagged 'ovkas' — monetization shell signal.
• uninstall_url_hijack crx setUninstallURL points to gameograf.com with identical UTM params — confirms traffic harvesting.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab controlled by extension.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email halilseker3455@gmail.com; no verified business domain; no publisher badge.
• js_external_hosts crx Extension contacts gameograf.com plus YouTube, Netflix, Instagram, x.com — broad external surface.
• no_csp manifest content_security_policy is null; MV3 strict default applies but no explicit policy declared.
• search_permission_plus_newtab manifest 'search' permission combined with newtab override enables search-provider monetization.

Permissions Breakdown

• search medium Allows querying browser search API; combined with newtab override elevates monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab — primary monetization/tracking surface for wallpaper shells.

Pillar Scores

Bookkeeping