Top Risks

• Uninstall AND install URL both hijack to gameograf.com — classic traffic-monetization shell pattern.
• Privacy policy is Google's own account policy (scope_extension=false, data_collection=true, third_party_sharing=true) — worst-class disclosure.
• NewTab override with search permission routes all new-tab traffic through developer-controlled page.
• Free-webmail dev (gmail), no developer name, no business website — unverifiable identity.
• Extension contacts gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com from JS.

Evidence

• install_url_hijack crx onInstalled opens gameograf.com with UTM params (ovkas campaign) — ad-monetization fingerprint.
• uninstall_url_hijack crx setUninstallURL to gameograf.com with identical UTM params — confirmed monetization shell.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab captured by extension.
• privacy_policy_generic store Policy URL is Google account-level policy; scope_extension=false, admits data_collection+third_party_sharing.
• developer_identity store Free Gmail address, no developer_name, no business domain — unverifiable operator.
• js_external_hosts crx Extension JS contacts 6 external hosts incl. gameograf.com, instagram.com, netflix.com, x.com.
• verified_publisher store Marked verified_publisher=true but Gmail email + no business domain undermines trust signal.
• game_portal_shell crx gameograf.com is a game-portal domain; install+uninstall redirects confirm game-portal shell pattern.

Permissions Breakdown

• search medium Allows reading/manipulating search queries; medium concern in NewTab context.
• chrome_url_overrides.newtab high Hijacks every new tab; primary monetization surface for traffic diversion.

Pillar Scores

Bookkeeping