Top Risks

• Uninstall and install URL hijack both redirect to gameograf.com — confirmed monetization shell pattern.
• Privacy policy is Google's generic account policy: admits data collection + 3rd-party sharing, not scoped to this extension → +10.0 (D).
• NewTab override + search permission = full search-monetization surface; external JS contacts Google, Instagram, Netflix, YouTube, X.com.
• Free-webmail dev (halilseker3455@gmail.com), no verified publisher, no business website → Reputation floor 7.5.
• No CSP (MV3 strict default applies, but external JS hosts span 6 domains including major platforms).

Evidence

• uninstall_url_hijack manifest setUninstallURL → gameograf.com with UTM params (ovkas); clear traffic-monetization shell.
• install_url_hijack manifest onInstalled opens gameograf.com with same UTM params; double hijack confirmed.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab for monetization.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_dev store Developer email halilseker3455@gmail.com; no verified publisher; no business domain.
• external_js_hosts crx JS contacts gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com — 6 distinct domains.
• new_tab_monetization manifest search permission + newtab override + gameograf.com hijacks = textbook monetization-shell cluster.
• no_ratings store 0 ratings, 200 installs; no social proof or trust signals.

Permissions Breakdown

• search medium Allows manipulation of search provider; paired with newtab override creates full search-monetization surface.
• chrome_url_overrides.newtab high Replaces every new tab; primary monetization vector for this shell pattern.

Pillar Scores

Bookkeeping