Top Risks

• Uninstall AND install URL both hijacked to gameograf.com UTM-tagged traffic monetization.
• NewTab override replaces every new tab; search permission enables query interception.
• Privacy policy is Google's generic policy — does NOT scope to this extension; admits 3rd-party sharing.
• Free-webmail dev (gmail), no developer name, no verified business domain — unaccountable operator.
• External JS contacts gameograf.com plus major social platforms (Instagram, Netflix, YouTube, X) from newtab.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com with UTM ovkas tracking params.
• install_url_hijack crx onInstalled opens gameograf.com with same UTM ovkas params — install-time traffic monetization.
• newtab_override manifest chrome_url_overrides.newtab = index.html — controls every new tab page.
• generic_privacy_policy store Policy URL is myaccount.google.com/privacypolicy — scope_extension=false, admits data+3rd-party sharing.
• free_webmail_no_devname store Dev email halilseker3455@gmail.com, developer_name empty, no business domain.
• js_external_hosts_monetization crx Extension contacts gameograf.com plus instagram/netflix/youtube/x.com from newtab context.
• verified_publisher_claim store verified_publisher=true but monetization hits via gameograf.com cap discount to -1.0 (v3.5 rule E).
• csp_absent_mv3 manifest csp_present=false on MV3; no CSP declared despite external host contacts.

Permissions Breakdown

• search medium Paired with newtab override; enables search interception/monetization.
• chrome_url_overrides.newtab high Replaces every new tab — high-reach vector for ad injection and tracking.

Pillar Scores

Bookkeeping