Top Risks

• Uninstall URL hijack redirects to gameograf.com ad/monetization page on every uninstall.
• Install URL hijack opens gameograf.com on install — classic traffic monetization shell.
• Privacy policy is generic Google account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• NewTab override with search permission is a known ad-monetization pattern tied to gameograf.com.
• Free-webmail numbered-alias developer, no verified publisher, no business domain — low accountability.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → gameograf.com with utm_source=ovkas; explicit ad-traffic monetization on uninstall.
• install_url_hijack manifest onInstalled opens gameograf.com with ovkas UTM params; monetization shell pattern confirmed.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab controlled by extension.
• generic_privacy_policy store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• free_webmail_dev store Developer email halilseker3455@gmail.com; numbered alias; no business domain; not verified publisher.
• js_external_hosts crx Extension loads/contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — 5+ unrelated major origins.
• search_override manifest search permission declared alongside NewTab override; combined monetization surface.
• numbered_alias_email store halilseker3455 matches numbered-alias dev email pattern flagged in rubric (+3.0 webstore).

Permissions Breakdown

• search medium Allows overriding search provider; paired with NewTab override is a monetization vector.
• chrome_url_overrides.newtab medium Replaces every new tab with extension page; high-reach monetization surface.

Pillar Scores

Bookkeeping