Top Risks

• Install and uninstall URL hijacks redirect users to third-party yowgames.com with UTM tracking.
• Privacy policy admits data collection and third-party sharing without extension-specific scope.
• Broad content_scripts match *://*/* grants page access on all sites.
• Anonymous free-webmail developer with no verifiable business identity.
• MV3 extension declares no CSP; jQuery 3.6.0 bundled but no CVEs flagged.

Evidence

• install_url_hijack crx onInstalled opens yowgames.com landing page with UTM campaign params.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL points to yowgames.com with UTM tracking.
• broad_host_access crx content_scripts matches *://*/* while permissions[] only lists storage.
• privacy_policy_scope api Policy fetched; scope_extension=false, admits data_collection and third_party_sharing.
• developer_identity store Gmail address, no verified publisher badge, no business website beyond yowgames.com.
• csp_missing crx MV3 extension with content_security_policy null; csp_present false.
• code_scan crx 4 JS files scanned; code_findings_raw empty; obfuscation_score 0.0.
• cve_scan crx jquery 3.6.0 detected inline; cve_findings_raw empty per OSV feed.

Permissions Breakdown

• storage low Low-impact preference storage only.
• content_scripts:*://*/* high Broad host access via content_scripts; injects into every site visited.

Pillar Scores

Bookkeeping