Top Risks

• Uninstall and install URL both hijacked to gameograf.com — classic traffic-monetization shell pattern.
• New-tab override combined with 'search' permission enables full search monetization on every new tab.
• Privacy policy is Google's generic policy (scope_extension=false, admits data collection + 3rd-party sharing) — rates +10 under v3.5 rule D.
• Extension contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — 5+ distinct JS host domains with no stated functional need.
• No CSP declared on MV3; manifest name/description are i18n placeholders only, obscuring true functionality.

Evidence

• install_url_hijack manifest onInstalled opens gameograf.com with ovkas UTM params — monetization shell indicator.
• uninstall_url_hijack manifest setUninstallURL targets gameograf.com with ovkas UTM params — +3.0 Webstore per rubric.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab served by extension.
• generic_privacy_policy store PP is Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy.
• js_external_hosts crx 6 external JS hosts: gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com — >3 distinct domains.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.
• obfuscated_manifest_strings manifest manifest_name and manifest_description are i18n message keys only — true function not disclosed in listing.
• no_ratings store 143 installs, 0 ratings; unverified publisher, not featured by Google.

Permissions Breakdown

• search medium Allows querying the browser search engine; combined with newtab override increases search monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab; primary vector for ad monetization and traffic redirection.

Pillar Scores

Bookkeeping