Top Risks

• Uninstall URL hijack to gamebol.com — persistent re-engagement tracking on removal
• Install URL hijack opens /Game_Source/index.html on install — install-time redirect
• Privacy policy fetched but scope_extension==false AND data_collection==true AND third_party_sharing==true — policy admits broad sharing not scoped to this extension
• Extension last updated 32 months ago — abandoned, no security patches
• Developer name missing; no 'Offered by' identity despite 500K installs

Evidence

• install_url_hijack crx onInstalled opens /Game_Source/index.html; +2.0 Webstore (install URL hijack)
• uninstall_url_hijack crx setUninstallURL to https://gamebol.com/ultimate-car-driving/; +3.0 Webstore per rubric
• privacy_policy_broad_sharing store fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy (v3.5 rule D)
• maintenance_stale store 32 months since last update → +8.5 Maintenance pillar
• no_developer_name store developer_name empty; +1.0 Reputation (no Offered By)
• verified_publisher store verified_publisher=true; normally -3.0 Reputation but capped at -1.0 (stale >18mo + monetization cap 0c/E)
• is_featured_by_google store Featured badge present; -2.0 Reputation discount applied
• operator_cluster_dev_email_siblings api sibling_counts_by_dim.dev_email=2 but compound sibling_count=0; no full operator cluster penalty applied

Pillar Scores

Bookkeeping