Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Subway Surfers Game [adware] [divergent] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall and install URL hijacks set with null targets — classic traffic/monetization shell pattern.
• Privacy policy is Google's generic account policy, not scoped to this extension; admits data collection and 3rd-party sharing.
• External JS hosted on gameograf.com (third-party game portal) — remote code loaded outside developer control.
• Free-webmail developer (gmail) with no developer name and no business domain; identity unverifiable.

Evidence

• uninstall_url_hijack + install_url_hijack crx Both onInstalled and uninstall URL hooks set; targets null but hooks present — monetization/traffic-redirect shell fingerprint.
• external_js_host crx js_external_hosts: [gameograf.com] — game portal CDN; remote code not under developer control.
• privacy_policy_generic store Policy URL is Google account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• developer_identity store Gmail developer email halilseker3455@gmail.com, no developer name, no business domain; verified_publisher=true but identity weak.
• manifest_placeholders crx manifest_name and manifest_description use __MSG__ keys — obfuscates stated purpose at review time.
• no_permissions_declared manifest permissions[], host_permissions[], content_scripts_matches all empty; surface area hidden in JS loaded from gameograf.com.
• low_installs_game_shell store Only 61 installs, 0 rating; Entertainment/game shell with hijack hooks and third-party JS is high-risk pattern.
• csp_absent crx content_security_policy is null; MV3 default CSP applies but external JS host gameograf.com still loaded.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Subway Surfers Game [adware] [divergent] + malext.io malicious_extension_sentry; score 4.46 -> 6.96 (+2.5 cap 2.5).

Pillar Scores

Bookkeeping