Top Risks

• Uninstall URL hijack redirects to gameograf.com ad-campaign endpoint on removal.
• Install URL hijack opens gameograf.com ad-campaign on first install — traffic monetization confirmed.
• Privacy policy URL unreachable (fetch error); privacy pillar scores maximum (10.0).
• New-tab override + search permission = full search-monetization shell disguised as wallpaper.
• Free-webmail dev (gmail), no developer name, no verified business — identity unverifiable.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com with utm_source=ovkas; confirmed ad-monetization redirect.
• install_url_hijack crx onInstalled opens gameograf.com with UTM params; monetization shell pattern confirmed.
• newtab_override manifest chrome_url_overrides.newtab = index.html; extension hijacks every new tab for a wallpaper/search page.
• privacy_policy_fetch_failed api fetched=false, reason=HTTPError; ovkas.com/privacy-policy/ unreachable. Max privacy risk applied.
• free_webmail_no_dev_name store developer_email=halilseker3455@gmail.com, developer_name empty. No verifiable business identity.
• js_external_hosts_social_platforms crx JS contacts gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com — 6 external hosts.
• verified_publisher_with_monetization store verified_publisher=true but uninstall/install hijacks to ad-tech; v3.5-E caps discount to -1.0.
• no_csp manifest content_security_policy=null on MV3; no additional CSP hardening present.

Permissions Breakdown

• search medium Allows overriding search provider; paired with newtab override = search monetization surface.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary vector for traffic and search monetization.

Pillar Scores

Bookkeeping