Top Risks

• Uninstall AND install URL both hijack to gameograf.com with UTM tracking — classic monetization shell.
• Privacy policy is Google's own generic policy (scope_extension=false, data_collection=true, third_party_sharing=true) — scores +10.
• Free-webmail dev (halilseker3455@gmail.com) with no verified business; reputation floor triggered.
• NewTab override with search permission and 6 external JS hosts including social/video platforms.
• No content security policy on MV3 extension with external host contact to gameograf.com.

Evidence

• install_url_hijack crx onInstalled opens gameograf.com with UTM params — monetization shell install hook.
• uninstall_url_hijack crx setUninstallURL to gameograf.com with UTM params — 3rd-party monetization on uninstall.
• newtab_override manifest chrome_url_overrides.newtab = index.html; search permission; monetization shape.
• generic_privacy_policy store Policy is Google's own account policy: scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_dev store Developer email halilseker3455@gmail.com; no verified business domain; numbered alias pattern.
• external_js_hosts crx 6 external hosts: gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension with external contacts.
• webstore_new_tab_monetization store NewTab + search override + install/uninstall URL hijack to gameograf.com = monetization shell pattern.

Permissions Breakdown

• search medium Allows search-provider interaction; paired with newtab override elevates risk.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary monetization surface for this shell pattern.

Pillar Scores

Bookkeeping