Top Risks

• NewTab override hijacks every new tab; paired with search permission enables search monetization.
• Uninstall URL redirects to gameograf.com with UTM tracking — confirmed traffic-monetization on exit.
• Install URL hijack opens ovkas.com on install — standard ad-shell onboarding pattern.
• Privacy policy is Google's generic account policy, not scoped to this extension; admits data collection and 3rd-party sharing.
• Free-webmail developer (gmail), no verified publisher, no business website — low accountability.

Evidence

• newtab_override manifest chrome_url_overrides.newtab → index.html; replaces every new tab for all users.
• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?utm_source=ovkas — 3rd-party monetization domain on exit.
• install_url_hijack crx onInstalled opens https://ovkas.com — classic ad-shell install redirect.
• privacy_policy_generic api Policy URL is Google's own account policy (scope_extension=false, data_collection=true, third_party_sharing=true).
• free_webmail_developer store Developer email halilseker3455@gmail.com; no verified publisher; no business website confirmed.
• js_external_hosts crx 8 external JS hosts: gameograf.com, games.ovkas.com, ovkas.com, google.com, instagram.com, netflix.com, youtube.com, x.com.
• search_permission_with_newtab manifest search permission + newtab override is a known search-monetization combo.
• csp_absent manifest content_security_policy is null; MV3 default applies but no explicit policy declared.

Permissions Breakdown

• search medium Allows reading/manipulating search queries; combined with newtab override amplifies monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab page; primary surface for traffic monetization and ad injection.

Pillar Scores

Bookkeeping