Top Risks

• Uninstall URL hijack redirects to gameograf.com with UTM tracking — explicit monetization shell.
• Install URL hijack redirects to same gameograf.com ad-tech domain on every install.
• NewTab override combined with search permission: full control over user's search and new-tab surface.
• Privacy policy is Google's generic policy — not scoped to this extension, yet extension data collection admitted; scores +10.0 per v3.5 rule D.
• No developer name supplied; no rating; 159 installs only — low-accountability throwaway-pattern extension.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com with ovkas UTM params; +3.0 Webstore.
• install_url_hijack crx onInstalled opens gameograf.com with ovkas UTM params; +2.0 Webstore.
• newtab_override manifest chrome_url_overrides.newtab=index.html; scored as HIGH permission +2.0 Permissions.
• privacy_policy_generic store Policy URL is Google's own policy; scope_extension=false, data_collection=true, third_party=true → +10.0 Privacy (rule D).
• js_external_hosts_monetization crx gameograf.com in js_external_hosts; also contacts instagram, netflix, youtube, x.com — broad non-stated reach.
• verified_publisher_newtab_capability_gate store Verified publisher discount capped at -1.0 (v3.5-E): monetization hits via gameograf + newtab override active.
• no_developer_name store developer_name empty; +1.0 Reputation per rubric.
• csp_absent_mv3 manifest csp_present=false on MV3; no v2 +2.0 Network penalty (MV3 strict default), no CVE amplifier triggered.

Permissions Breakdown

• search medium Allows overriding search provider; combined with NewTab override amplifies monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab with extension-controlled page; primary vector for ad-monetization.

Pillar Scores

Bookkeeping