Top Risks

• Uninstall and install URL both hijack to gameograf.com — classic traffic-monetization shell pattern.
• Privacy policy URL is generic Google account page; fetch failed (SSL error) — no scoped policy exists.
• Operator cluster: 9 extensions share same install/uninstall URL fingerprint under free-webmail dev.
• New-tab override + search permission with free-webmail developer and no verified publisher status.
• No privacy policy disclosing what data the newtab replacement collects or shares.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com with UTM params tied to 'ovkas' campaign.
• install_url_hijack crx onInstalled opens gameograf.com with same UTM params — confirms monetization shell intent.
• operator_cluster api 9 extensions share same install/uninstall URL; 2 share compound fingerprint with this extension.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new-tab page for all users.
• privacy_policy_fetch_failed api Declared policy URL is Google account page; fetch_error:SSLError — no extension-scoped policy.
• free_webmail_developer store Developer email halilseker3455@gmail.com; no verified publisher; no business domain.
• js_external_hosts crx Extension contacts gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com.
• no_csp manifest content_security_policy is null (MV3 default applies, but no explicit scope hardening declared).

Permissions Breakdown

• search medium Can override search provider settings; paired with newtab override is a monetization vector.
• chrome_url_overrides.newtab medium Replaces new-tab page; central to traffic-monetization shell pattern.

Pillar Scores

Operator Siblings (3)

Other extensions sharing this developer's compound fingerprint:

• pnnajndbaillimdgjfafambpcddaomfj
• giiedinejlhaaeibpbbjfdfhbieidffb
• onflifpnebfbgfjmgebmjolnfgfjhhec

Bookkeeping