Top Risks

• Uninstall URL hijack and install URL hijack both redirect to gameograf.com ad/tracking portal.
• Privacy policy is Google's generic policy — scope_extension=false, data_collection=true, third_party_sharing=true; scores as worst-case under v3.5(D).
• NewTab override with search permission and external JS hosts (Instagram, Netflix, YouTube, X) — classic ad-monetization NewTab shell.
• Free-webmail developer (gmail), no developer name, no verified business domain — high reputation risk.
• Developer explicitly linked to gameograf.com UTM tracking campaign across both install and uninstall hooks.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → https://gameograf.com/?utm_source=ovkas (ad-tech redirect on removal).
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=ovkas — monetization redirect on install.
• generic_privacy_policy store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• newtab_override manifest chrome_url_overrides.newtab=index.html replaces every new tab; search permission also declared.
• free_webmail_dev_no_name store Developer email halilseker3455@gmail.com, developer_name empty, no business domain.
• external_js_hosts crx JS contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — wide tracking surface.
• new_tab_monetization_shape manifest NewTab + search override + UTM-tagged uninstall/install URLs = textbook traffic-monetization shell.
• verified_publisher_claimed store verified_publisher=true but developer_name empty and policy is generic Google policy; limited trust discount.

Permissions Breakdown

• search medium Allows overriding search provider; paired with newtab override amplifies monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; core NewTab monetization surface.

Pillar Scores

Bookkeeping