Top Risks

• Uninstall and install URL hijacks redirect users to yowgames.com with UTM tracking — classic monetization-shell pattern.
• Content script on *://*/*reenables broad-page reach despite no declared host_permissions.
• Privacy policy (yowgames.com) admits data collection and third-party sharing but is not scoped to this extension.
• Free-webmail developer (afraezgi4@gmail.com) with no verified publisher badge raises accountability concerns.
• Privacy policy fetched but scope_extension==false and data_collection+third_party_sharing==true → worst-case privacy disclosure.

Evidence

• install_url_hijack manifest onInstalled opens yowgames.com with UTM params — install URL hijack confirmed.
• uninstall_url_hijack manifest setUninstallURL points to yowgames.com with UTM tracking — webstore +3.0 each per rubric.
• content_scripts_broad manifest content_scripts_matches=[*://*/*] injects JS on all sites, broad REACH despite minimal permissions[].
• privacy_policy_scope_mismatch api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → D-clause +10.0 privacy.
• free_webmail_developer store Developer email afraezgi4@gmail.com; no verified publisher, no business domain identity.
• js_external_host crx js_external_hosts=[yowgames.com]; extension contacts external domain matching install/uninstall hijack target.
• no_csp manifest content_security_policy=null on MV3; MV3 strict default applies, no additional v2 penalty but csp_present=false noted.
• jquery_3.6.0_bundled crx jquery 3.6.0 bundled; cve_findings_raw empty so no CVE score added.

Permissions Breakdown

• storage low Stores cursor preference settings locally; standard low-risk use.
• content_scripts *://*/* high Runs JS on every page the user visits; broad reach even without explicit host_permissions.

Pillar Scores

Bookkeeping