Top Risks

• Uninstall AND install URL hijacks redirect to gameograf.com ad/tracking funnel.
• Minecraft brand impersonation by unverified gmail dev — no IP ownership.
• Privacy policy is generic Google account policy; does not scope this extension at all (data_collection+third_party_sharing admitted, scope_extension=false → +10).
• NewTab override with external JS contacts Google, Instagram, Netflix, YouTube, X — monetization aggregator pattern.
• Free-webmail developer, no verified publisher, no business domain — low accountability.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com with UTM campaign tracking params.
• install_url_hijack crx onInstalled opens gameograf.com with UTM params — traffic monetization on install.
• brand_impersonation store brand_mention.is_impersonation=true for 'minecraft'; developer is gmail user with no confirmed ownership.
• generic_privacy_policy api Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• newtab_override manifest chrome_url_overrides.newtab=index.html replaces every new tab session.
• external_js_hosts crx JS contacts gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com — 6 unrelated origins.
• free_webmail_developer store Developer email ulasaskin728@gmail.com; no business domain; not verified publisher.
• search_permission_newtab_combo manifest 'search' permission combined with newtab override enables search-query monetization.

Permissions Breakdown

• search medium Allows reading/manipulating search queries; medium risk on its own.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary monetization surface for this extension.

Pillar Scores

Bookkeeping