Top Risks

• Uninstall AND install URL both hijacked to gameograf.com UTM affiliate — classic monetization shell.
• Privacy policy is Google's generic policy (scope_extension=false, data_collection+3rd_party_sharing=true) — worst-case D clause: +10.
• NewTab override + search permission enables search query interception and ad-revenue redirection.
• Free-webmail Gmail dev, no verified publisher, no business domain — low accountability.
• Extension contacts 6 external JS hosts (Google, Instagram, Netflix, YouTube, X, gameograf.com) with no CSP.

Evidence

• install_url_hijack + uninstall_url_hijack manifest Both onInstall and onUninstall redirect to gameograf.com with UTM params — affiliate monetization shell pattern (+2+3=5 Webstore).
• chrome_url_overrides.newtab manifest NewTab override present; combined with search permission enables search-query monetization.
• privacy_policy_generic_google store Policy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true → v3.5 D clause +10.
• free_webmail_developer store Developer email oktaybahcivan27@gmail.com; no business website; not verified publisher.
• js_external_hosts crx 6 external hosts contacted: gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com — no CSP, MV3.
• csp_present=false MV3 manifest No CSP declared; MV3 has strict default so no +2 MV2 penalty, but no CSP + external hosts raises surface.
• new_tab_override_monetization manifest NewTab override with monetization shape (+2.0 Webstore) stacking with install/uninstall URL hijacks.
• operator_cluster_sibling_count_0 api No sibling extensions detected under this fingerprint; solo operator with 18 installs.

Permissions Breakdown

• search medium Allows reading/modifying search queries; paired with newtab override enables search monetization.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary surface for ad/search monetization in wallpaper shells.

Pillar Scores

Bookkeeping