Top Risks

• Uninstall URL hijack redirects to gameograf.com ad-tech portal — confirmed monetization shell pattern.
• Install URL hijack on onInstalled also redirects to gameograf.com; double-hijack is a strong monetization signal.
• Privacy policy URL fetch failed (HTTPError); privacy pillar scores maximum risk.
• NewTab override with 'search' permission and external JS hosts (Instagram, Netflix, YouTube, x.com) beyond stated function.
• Free-webmail Gmail developer, no developer name, no verified business domain — low accountability.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com with ovkas UTM params; confirmed 3rd-party redirect.
• install_url_hijack crx onInstalled opens gameograf.com with same ovkas UTM params; double install/uninstall hijack.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab served by extension.
• privacy_policy_fetch_failed api ovkas.com/privacy-policy returned HTTPError; policy cannot be evaluated — scored as no policy.
• external_js_hosts_broad crx 6 external hosts: gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com.
• free_webmail_no_dev_name store Developer email halilseker3455@gmail.com; developer_name empty; no verified business.
• verified_publisher store Verified publisher badge present but does not override monetization shell signals.
• game_portal_shell crx gameograf.com is a game portal; UTM tracking from install/uninstall confirms traffic-monetization pattern.

Permissions Breakdown

• search medium Allows reading/modifying search settings; combined with newtab override raises monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; primary surface for ad/affiliate monetization.

Pillar Scores

Bookkeeping