Top Risks

• Uninstall and install URL both hijack to gameograf.com ad-monetization site (+6.0 Webstore).
• chrome_url_overrides.newtab replaces every new tab; combined with search permission = search hijack.
• Privacy policy is Google's generic account policy — does not scope to this extension at all (+10.0 Privacy).
• Free-webmail Gmail developer with no verified publisher badge; looks-throwaway fingerprint.
• Extension contacts gameograf.com, major social/media domains with no CSP; broad outbound surface.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → gameograf.com with UTM tracking params; clear ad-monetization shell.
• install_url_hijack manifest onInstalled opens gameograf.com with identical UTM params; double hijack pattern.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab controlled by this extension.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's account policy, not scoped to extension.
• js_external_hosts crx Contacts gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com — 6 distinct domains.
• no_csp manifest content_security_policy is null; no script-src restriction on MV3 extension pages.
• free_webmail_developer store Developer email hayrettinkaya827@gmail.com; no verified publisher, no business domain.
• game_portal_shell store gameograf.com destination + newtab override + install/uninstall hijack matches game-portal monetization shell.

Permissions Breakdown

• search medium Allows querying browser search; paired with newtab override becomes a search hijack surface.
• chrome_url_overrides.newtab high Replaces every new tab; primary monetization vector for gameograf.com redirect.

Pillar Scores

Bookkeeping