Top Risks

• Uninstall URL hijack to yowgames.com with UTM tracking — explicit monetization on uninstall.
• Install URL hijack to yowgames.com — traffic harvesting on every new install.
• Privacy policy does not scope to this extension despite admitting data collection and third-party sharing.
• Free-webmail developer (gmail) with no verified business identity; policy domain mismatch.
• Content script runs on all URLs (*://*/*) giving broad page-level access despite low formal permissions.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → yowgames.com with UTM tracking; explicit 3rd-party traffic monetization on uninstall.
• install_url_hijack manifest onInstalled opens yowgames.com with UTM params; harvests install event traffic to external domain.
• content_scripts_broad manifest content_scripts_matches: ['*://*/*'] — injected on every HTTP/S page the user visits.
• privacy_policy_unscoped api Policy fetched from yowgames.com; scope_extension=false, data_collection=true, third_party_sharing=true — D clause triggers +10.0.
• free_webmail_developer store Developer email uralsinem026@gmail.com; no verified publisher badge; policy domain yowgames.com differs.
• low_rating store Rating 1.5 — very low user satisfaction signal.
• js_external_host crx Extension contacts yowgames.com externally; same domain as install/uninstall hijack target.
• csp_absent manifest content_security_policy is null (MV3 so no +2.0 Network penalty, but no mitigation layer present).

Permissions Breakdown

• storage low Used to persist cursor preference settings; low standalone risk.
• content_scripts *://*/* high Content script injected on every site visited; broad reach despite no declared host_permissions.

Pillar Scores

Bookkeeping