Top Risks

• Uninstall URL hijack redirects to gameograf.com ad-campaign tracker — monetization shell pattern.
• Install URL hijack also redirects to gameograf.com with UTM campaign tags on install.
• New-tab override combined with 'search' permission enables search-provider hijacking.
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Free-webmail developer (gmail), no verified publisher, numbered-alias email pattern suggests throwaway operator.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL targets gameograf.com with ovkas UTM tags — classic monetization shell.
• install_url_hijack crx onInstalled opens gameograf.com with ovkas UTM tags — traffic monetization on install.
• newtab_override manifest chrome_url_overrides.newtab = index.html; extension hijacks every new tab.
• search_permission manifest Declares 'search' permission enabling search-provider override.
• generic_privacy_policy store Policy is Google's own account policy (scope_extension=false, data_collection=true, third_party_sharing=true) — v3.5 D applies: +10.0.
• free_webmail_developer store Developer email halilibrahimseker125@gmail.com; no verified publisher; no business domain.
• js_external_hosts_social_platforms crx Extension contacts google.com, instagram.com, netflix.com, youtube.com, x.com — broad social quick-links typical of NewTab shells.
• no_cve_findings crx jquery 3.7.1 bundled; no CVEs found in cve_findings_raw. CVE pillar = 0.0.

Permissions Breakdown

• search medium Allows overriding the browser search provider, enabling search hijacking.
• chrome_url_overrides.newtab medium Replaces the new tab page; primary surface for monetization and tracking.

Pillar Scores

Bookkeeping