Top Risks

• Uninstall and install URL hijacks set with null targets — classic traffic/monetization shell pattern.
• Privacy policy is Google's generic account policy, not scoped to this extension; admits data collection and 3rd-party sharing.
• External JS hosted on gameograf.com (third-party game portal) — remote code loaded outside developer control.
• Free-webmail developer (gmail) with no developer name and no business domain; identity unverifiable.
• Manifest uses localised message placeholders (__MSG__) with zero declared permissions — minimal observable surface but unverifiable intent.

Evidence

• uninstall_url_hijack + install_url_hijack crx Both onInstalled and uninstall URL hooks set; targets null but hooks present — monetization/traffic-redirect shell fingerprint.
• external_js_host crx js_external_hosts: [gameograf.com] — game portal CDN; remote code not under developer control.
• privacy_policy_generic store Policy URL is Google account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• developer_identity store Gmail developer email halilseker3455@gmail.com, no developer name, no business domain; verified_publisher=true but identity weak.
• manifest_placeholders crx manifest_name and manifest_description use __MSG__ keys — obfuscates stated purpose at review time.
• no_permissions_declared manifest permissions[], host_permissions[], content_scripts_matches all empty; surface area hidden in JS loaded from gameograf.com.
• low_installs_game_shell store Only 61 installs, 0 rating; Entertainment/game shell with hijack hooks and third-party JS is high-risk pattern.
• csp_absent crx content_security_policy is null; MV3 default CSP applies but external JS host gameograf.com still loaded.

Pillar Scores

Bookkeeping