Top Risks

• Uninstall and install URL both hijacked to gameograf.com with UTM tracking — classic traffic-monetization shell.
• NewTab override combined with 'search' permission routes users through developer-controlled search/ad funnel.
• Privacy policy is Google's generic account policy (scope_extension=false, admits data collection + 3rd-party sharing) — maps to +10.0.
• JS contacts major platforms (Google, YouTube, Instagram, Netflix, X) from newtab page — broad surveillance surface.
• No developer name listed; verified publisher badge provides limited assurance given monetization signals.

Evidence

• uninstall_url_hijack crx uninstall_url_target=https://gameograf.com/?utm_source=ovkas — 3rd-party redirect on uninstall (+3.0 webstore).
• install_url_hijack crx install_url_target=https://gameograf.com/?utm_source=ovkas — 3rd-party redirect on install (+2.0 webstore).
• newtab_override manifest chrome_url_overrides.newtab=index.html; NewTab override with monetization shape (+2.0 webstore).
• privacy_policy_generic store Policy is Google Account policy: scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• js_external_hosts crx Extension contacts gameograf.com + Instagram/Netflix/YouTube/X from newtab — 6 distinct hosts including ad-tech.
• no_csp crx content_security_policy is null (MV3 with no explicit CSP); v2 fix: +2.0 network for MV2 not applicable but noted.
• no_developer_name store developer_name is empty string; +1.0 reputation (no Offered-by name).
• verified_publisher store verified_publisher=true; -3.0 reputation discount applied, but monetization signals limit trust.

Permissions Breakdown

• search medium Allows reading and manipulating browser search behavior; paired with newtab override increases monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; primary vector for ad/search monetization shells.

Pillar Scores

Bookkeeping