Top Risks

• Uninstall AND install URL hijack both point to gameograf.com ad-tracker with UTM params.
• Privacy policy is Google's own policy (generic, not scoped), admits data collection and 3rd-party sharing.
• New-tab override with 'search' permission forms a classic search-monetization shell.
• Free-webmail dev (gmail), no verified publisher, no business website — unverifiable operator.
• External JS hosts include gameograf.com plus major platforms (Netflix, Instagram, YouTube, X) with no CSP.

Evidence

• install_url_hijack crx onInstalled opens gameograf.com with UTM tags identifying developer 'ovkas' — classic traffic monetization.
• uninstall_url_hijack crx setUninstallURL points to gameograf.com with same UTM params — +3.0 webstore penalty applied.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab controlled by extension.
• generic_privacy_policy store Policy is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true) → +10.0.
• free_webmail_dev store halilibrahimseker125@gmail.com — numbered alias pattern, no business domain, Reputation floor 7.5.
• js_external_hosts crx gameograf.com plus Netflix, Instagram, YouTube, X.com contacted — >3 distinct domains, no CSP.
• new_tab_monetization manifest search permission + newtab override + gameograf.com redirect = monetization shell pattern.
• csp_absent crx content_security_policy is null; MV3 default applies but external host contact without CSP raises network risk.

Permissions Breakdown

• search medium Allows querying the browser search API; paired with newtab override enables search monetization.
• chrome_url_overrides.newtab high Replaces every new tab with extension-controlled page; primary monetization/tracking surface.

Pillar Scores

Bookkeeping