Top Risks

• Uninstall and install URL hijacks redirect to gameograf.com — clear monetization shell pattern.
• Privacy policy is generic Google account policy with no extension-specific scope; data_collection and third_party_sharing both true.
• NewTab override + search permission replaces every new tab for ad/search revenue; game-portal shell fingerprint.
• Free-webmail developer (halilseker3455@gmail.com) with no verified business website.
• External JS hosts include gameograf.com alongside major platforms (YouTube, Netflix, Instagram) with no CSP.

Evidence

• uninstall_url_hijack manifest setUninstallURL targets gameograf.com with UTM params — monetization shell fingerprint.
• install_url_hijack manifest onInstalled opens gameograf.com — same domain, confirms game-portal shell.
• newtab_override manifest chrome_url_overrides.newtab set to index.html; every new tab captured.
• generic_privacy_policy store Privacy URL is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true).
• free_webmail_developer store Developer email halilseker3455@gmail.com; no business domain; developer_domain_info=null.
• external_hosts crx JS contacts gameograf.com + Google/Instagram/Netflix/YouTube/X with no CSP; MV3 but csp_present=false.
• search_permission_plus_newtab manifest search permission combined with newtab override is canonical search-monetization pattern.
• no_verified_publisher store Not verified, not featured; rating=0, installs unknown; Webstore accountability minimal.

Permissions Breakdown

• search medium Allows querying and potentially overriding search; combined with newtab override raises monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; primary monetization surface for NewTab shells.

Pillar Scores

Bookkeeping