Top Risks

• Uninstall URL hijack redirects to gameograf.com ad-tracker with UTM campaign parameters.
• Install URL hijack fires immediately on install to same ad-tracker — classic monetization shell.
• New-tab override combined with 'search' permission enables search-redirect monetization.
• Privacy policy URL unreachable (fetch_error); effectively no policy for 35 users.
• Free-webmail dev (gmail), no developer name, no business domain — zero accountability.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL -> gameograf.com with UTM ovkas campaign; classic ad-monetization exfil.
• install_url_hijack crx onInstalled opens gameograf.com UTM URL; double-hijack pattern (install + uninstall).
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab served by extension.
• privacy_policy_fetch_failed api https://ovkas.com/privacy-policy returned HTTPError; policy effectively absent.
• free_webmail_no_dev_name store Dev email halilseker3455@gmail.com, developer_name empty; no verifiable business identity.
• js_external_hosts crx Extension contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — 5 unrelated domains.
• verified_publisher_flag store Marked verified_publisher=true despite gmail dev; does not resolve monetization-hijack risk (cap applies).
• new_tab_monetization_pattern manifest search perm + newtab override + dual URL hijack + UTM tracking = textbook traffic-monetization shell.

Permissions Breakdown

• search medium Allows reading/manipulating search queries; paired with newtab override raises search-hijack risk.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; primary monetization surface for this shell pattern.

Pillar Scores

Bookkeeping