Top Risks

• Uninstall URL hijack redirects to gameograf.com — confirmed third-party monetization redirect.
• Privacy policy is Google's own policy (not extension-scoped) but admits data collection and third-party sharing.
• NewTab override + 'search' permission = classic ad-monetization shell; installs on every new tab open.
• Free-webmail developer email (gmail) with no verified publisher status raises accountability gap.
• 7 external JS hosts (dekuy.com, gameograf.com, goo.gl, etc.) with no CSP — broad remote dependency surface.

Evidence

• uninstall_url_hijack manifest setUninstallURL targets gameograf.com with dekuy UTM params — clear third-party monetization on uninstall.
• install_url_hijack manifest onInstalled opens index.html; low severity but consistent with shell pattern.
• newtab_override manifest chrome_url_overrides.newtab = index.html replaces every new tab for all users.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Dev email forcrashbandicoot55@gmail.com; no verified publisher; numbered-alias pattern.
• external_js_hosts crx 7 external hosts including gameograf.com and goo.gl; no CSP to restrict them.
• no_csp manifest content_security_policy is null on MV3; no constraint on external script execution.
• search_permission_newtab_combo manifest 'search' permission + newtab override matches traffic-monetization cluster fingerprint.

Permissions Breakdown

• search medium Allows search provider manipulation; paired with newtab override amplifies monetization risk.
• chrome_url_overrides.newtab high Replaces new tab page; core NewTab monetization vector enabling ad/redirect injection.

Pillar Scores

Bookkeeping