Top Risks

• Uninstall AND install URL both hijack to gameograf.com with UTM tracking — textbook monetization shell.
• Privacy policy is Google's generic policy (scope_extension=false, admits data collection + 3rd-party sharing) — earns maximum privacy score.
• NewTab override + search permission with free-webmail dev and no verified publisher identity.
• GTA VI brand name used as lure title by unverified Gmail developer — likely fan-content/game-portal shell.
• No CSP; extension contacts 6 external hosts including social/streaming platforms from newtab page.

Evidence

• uninstall_url_hijack crx setUninstallURL → gameograf.com with UTM params tied to 'ovkas' campaign tag.
• install_url_hijack crx onInstalled opens gameograf.com with same UTM params — dual redirect monetization.
• privacy_policy_generic store Policy is Google account privacy page: scope_extension=false, data_collection=true, third_party_sharing=true.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab for all users.
• free_webmail_dev store Developer email halilseker3455@gmail.com — numbered alias pattern, no verified business.
• game_portal_shell store Title uses GTA VI brand; dev not affiliated; fan-content/game-portal shell pattern.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• external_hosts crx JS contacts gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com — 6 hosts.

Permissions Breakdown

• search medium Can manipulate search provider settings; paired with newtab override this is a monetization vector.
• chrome_url_overrides.newtab medium Replaces new-tab page; core mechanism for ad-monetization shells.

Pillar Scores

Bookkeeping