Top Risks

• Uninstall URL hijack routes users to yowgames.com with UTM tracking — classic monetization/data-harvest signal.
• Install URL hijack also redirects to yowgames.com with UTM params — double URL hijack pattern.
• Privacy policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true — admits broad data sharing without scoping to this extension (D rule: +10.0 privacy).
• Free-webmail developer (gmail) with no verified business identity and yowgames.com policy domain mismatch from developer email.
• Content scripts injected on *://*/* giving full-page JS reach on every site the user visits.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() → yowgames.com with UTM tracking params; +3.0 Webstore.
• install_url_hijack crx onInstalled opens yowgames.com with UTM tracking params; +2.0 Webstore.
• privacy_policy_classification api fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true → D-rule +10.0 Privacy.
• free_webmail_developer store Developer email uralsinem026@gmail.com; no verified publisher, no business website. Reputation +1.5.
• content_scripts_broad manifest content_scripts_matches=[*://*/*] — JS injected on every HTTP/HTTPS page.
• low_rating store Rating 2.7 — below average quality signal.
• js_external_hosts crx Contacts chrome.google.com and yowgames.com; 2 distinct registrable domains.
• no_csp manifest content_security_policy=null (MV3 default applies, no explicit CSP declared).

Permissions Breakdown

• storage low Stores cursor preference locally; low capability, standard for this category.
• content_scripts *://*/* high Runs JS on every page — high reach even without explicit host_permissions declaration.

Pillar Scores

Bookkeeping