Top Risks

• Uninstall URL hijack routes to yowgames.com ad/tracking page (+3.0 webstore).
• Install URL hijack opens yowgames.com UTM-tagged page on install (+2.0 webstore).
• Privacy policy admits data collection and third-party sharing but is not scoped to this extension (+10.0 privacy).
• Free-webmail developer (gmail) with no verified business; numbered-alias-style email (+1.5 reputation).
• Content scripts run on all URLs giving broad page-level reach despite minimal declared permissions.

Evidence

• uninstall_url_hijack manifest setUninstallURL targets yowgames.com with UTM params — monetization redirect confirmed.
• install_url_hijack manifest onInstalled opens yowgames.com with UTM params — install-time redirect confirmed.
• privacy_policy_generic store Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — not scoped to extension.
• free_webmail_developer store Developer email ayseozkacar237@gmail.com with no verified publisher badge.
• content_scripts_all_urls manifest content_scripts_matches=[*://*/*] — runs on every page the user visits.
• js_external_hosts crx Extension references yowgames.com externally in addition to chrome.google.com.
• no_csp manifest content_security_policy is null; MV3 provides strict defaults but no explicit CSP declared.
• operator_cluster_sibling_0 api No sibling extensions detected under same fingerprint; isolated but email is free-webmail.

Permissions Breakdown

• storage low Stores cursor preferences locally; minimal risk.
• content_scripts *://*/* medium Injects script into every page; broad reach even if narrow stated purpose.

Pillar Scores

Bookkeeping