Top Risks

• Dual URL hijack (install+uninstall) to gameograf.com — explicit traffic-monetization shell pattern.
• NewTab override + 'search' permission enables full search-query capture and ad monetization on every tab.
• Privacy policy is Google's generic account policy — not scoped to extension; admits data collection and 3rd-party sharing.
• 6 external JS hosts (gameograf.com + social platforms) with no CSP — data exfiltration surface with no constraint.
• Empty developer name despite verified_publisher; fan-art theme (anime) is common shell pattern.

Evidence

• install_url_hijack manifest onInstalled opens gameograf.com with ovkas UTM tags — explicit monetization redirect on install.
• uninstall_url_hijack manifest setUninstallURL points to gameograf.com with ovkas UTM tags — monetization on uninstall.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab served by this extension.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's policy, scope_extension=false, data_collection+third_party_sharing=true.
• js_external_hosts crx Extension loads from gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com — 6 external hosts, no CSP.
• no_developer_name store developer_name is empty string; reduces accountability even with verified_publisher flag.
• verified_publisher store verified_publisher=true provides some accountability signal but does not explain monetization hooks.
• low_installs_monetization store Only 164 installs but dual URL hijack + newtab override + external hosts cluster = monetization shell pattern.

Permissions Breakdown

• search medium Allows reading/modifying search queries; paired with newtab override this enables search monetization.
• chrome_url_overrides.newtab high Replaces every new tab with extension page — primary vector for ad/affiliate monetization.

Pillar Scores

Bookkeeping