Top Risks

• Uninstall+install URL hijack both redirect to gameograf.com ad-tech domain — confirmed monetization shell.
• Brand impersonation: uses 'Minecraft' trademark; developer (gmail) is not a confirmed Microsoft/Mojang partner.
• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and third-party sharing.
• NewTab override with search permission hijacks every new tab page for ad-tech monetization.
• Free-webmail developer (halilseker3455@gmail.com) with no verifiable business identity or domain.

Evidence

• uninstall_url_hijack crx setUninstallURL → gameograf.com with UTM params; classic monetization shell exit pattern.
• install_url_hijack crx onInstalled opens gameograf.com with UTM params; drives traffic on install.
• newtab_override manifest chrome_url_overrides.newtab set to index.html; hijacks every new tab for monetization.
• brand_impersonation store brand_mention.is_impersonation=true for 'minecraft'; developer not a confirmed owner.
• privacy_policy_generic store Policy URL is Google's own account policy — scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email halilseker3455@gmail.com; no business domain; reputation floor applies.
• js_external_hosts crx Contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — 6 unrelated external hosts.
• new_tab_monetization_pattern manifest search permission + newtab override + install/uninstall hijack to same ad domain = monetization shell.

Permissions Breakdown

• search medium Allows manipulation of search provider; combined with NewTab override amplifies search-hijack risk.
• chrome_url_overrides.newtab high Replaces every new tab; primary monetization surface for this shell pattern.

Pillar Scores

Bookkeeping