Top Risks

• Uninstall and install URL both hijacked to gameograf.com with UTM tracking — confirmed monetization shell.
• Privacy policy is generic Google account policy (not scoped to this extension) yet classifies data_collection+third_party_sharing==true → Privacy pillar 10.0.
• NewTab override with search permission creates ad-monetization surface on every new tab open.
• Free-webmail developer (halilseker3455@gmail.com), no verified publisher, no business domain — high reputation risk.
• 6 external JS hosts including gameograf.com alongside major platforms; gameograf.com is the uninstall/install redirect target.

Evidence

• install_url_hijack crx onInstalled opens gameograf.com with utm_source=ovkas — confirmed 3rd-party redirect on install.
• uninstall_url_hijack crx setUninstallURL points to gameograf.com with utm tracking — monetization shell pattern.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab hijacked by this extension.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_dev store Developer email halilseker3455@gmail.com — numbered alias pattern, no business domain.
• js_external_hosts crx 6 external hosts: gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com.
• no_csp manifest content_security_policy is null; MV3 strict default applies but csp_present==false noted.
• search_permission_newtab_combo manifest search permission + newtab override together create search-monetization surface.

Permissions Breakdown

• search medium Allows overriding search provider; medium risk especially combined with newtab override.
• chrome_url_overrides.newtab high Replaces new tab page — primary monetization surface; high risk per v2 calibration rule (a).

Pillar Scores

Bookkeeping