Top Risks

• Uninstall URL hijack to yowgames.com with UTM tracking — monetization redirect on removal.
• Install URL hijack to yowgames.com on onInstalled — traffic harvesting on install.
• Privacy policy is generic yowgames.com policy, not scoped to this extension, yet admits data collection and third-party sharing.
• Developer email is free webmail (gmail) with no developer name listed, reducing accountability.
• Content script runs on all URLs (*://*/*) giving page-level access across every site visited.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → yowgames.com with UTM params; monetization/tracking on uninstall.
• install_url_hijack crx onInstalled opens yowgames.com with UTM params; traffic redirection on first install.
• privacy_policy_not_scoped store Policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true — generic site policy.
• free_webmail_dev_no_name store Dev email uralsinem026@gmail.com; developer_name empty; no verified business identity.
• content_scripts_all_urls manifest content_scripts_matches=[*://*/*] injects on every page despite only 'storage' permission declared.
• verified_publisher store verified_publisher=true provides some accountability signal; discounts reputation moderately.
• no_csp manifest csp_present=false on MV3; MV3 default CSP applies, no v2 network penalty triggered.
• js_library_jquery_3_6_0 crx jQuery 3.6.0 bundled; no CVEs reported in cve_findings_raw; no CSP amplifier triggered.

Permissions Breakdown

• storage low Used to save cursor preference settings locally; low standalone risk.
• content_scripts *://*/* medium Content script injected on every page; broad reach even without explicit host_permissions.

Pillar Scores

Bookkeeping