Top Risks

• Uninstall AND install URL hijack both redirect to gameograf.com — confirmed monetization shell pattern.
• Privacy policy is Google's own policy (scope_extension=false, data_collection=true, third_party_sharing=true) — worst-case D clause: +10.0.
• NewTab override + search permission = full search monetization surface on every new tab.
• No developer name; blank manifest name/desc (__MSG_ keys only); no 'Offered by' identity signal.
• Extension contacts gameograf.com, Instagram, Netflix, YouTube, X — 6 external hosts with no stated justification.

Evidence

• install_url_hijack + uninstall_url_hijack crx Both install and uninstall redirect to gameograf.com with ovkas UTM params — Webstore +3.0 each per rubric.
• privacy_policy_generic_google store PP URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true → Privacy +10.0 (v3.5 D).
• newtab_override manifest chrome_url_overrides.newtab replaces every new tab with index.html; monetization delivery vector.
• external_hosts_mismatch crx JS contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — 6 domains, no function justification for wallpaper.
• no_developer_name store developer_name is empty string; manifest name is __MSG_appName__; no 'Offered by' identity.
• verified_publisher store verified_publisher=true; -3.0 Reputation discount applied but monetization hits cap it to -1.0 per v3.5(E).
• csp_absent_mv3 manifest content_security_policy=null; MV3 has strict default so no +2.0 network penalty, but amplifier for jquery check skipped (no CVEs).
• operator_cluster_sibling_count_0 api No sibling extensions detected under this fingerprint; +2.5 cluster bonus not applied.

Permissions Breakdown

• search medium Allows querying/overriding search; combined with newtab override creates full search monetization surface.
• chrome_url_overrides.newtab high Replaces every new tab; core delivery vector for ad/monetization content; MEDIUM +1.0 scored as HIGH via v2(a).

Pillar Scores

Bookkeeping