Top Risks

• NewTab override hijacks every new tab to yowgames.com shell; uninstall+install URL both redirect to third-party ad domain.
• Privacy policy is Google's generic account policy — scope_extension=false, admits data collection & third-party sharing: scores 10.0.
• Free-webmail Gmail dev with no verified publisher badge; reputation floor 7.5 applies.
• js_external_hosts includes 8 unrelated major platforms (Netflix, Instagram, YouTube, X, OpenAI) — broad outbound surface.
• NewTab+search permission combo with yowgames.com backend is a classic traffic-monetization shell pattern.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → https://yowgames.com/uninstall — 3rd-party redirect on uninstall.
• install_url_hijack manifest onInstalled opens https://yowgames.com/dog-digital-art-live-wallpaper — 3rd-party redirect on install.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab controlled by extension.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_dev store Developer email ersanahmet83@gmail.com; no verified publisher; reputation floor 7.5.
• js_external_hosts crx 8 external hosts incl. Netflix, Instagram, YouTube, OpenAI, X — far beyond wallpaper stated function.
• game_portal_shell store Backend domain yowgames.com matches game-portal monetization shell pattern (+2.0).
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP declared.

Permissions Breakdown

• search medium Allows querying browser search API; combined with newtab override creates search-monetization surface.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; high-reach hijack vector scored under v2 calibration.

Pillar Scores

Bookkeeping