Top Risks

• Uninstall URL hijacked to gameograf.com with UTM tracking — confirmed monetization/traffic redirect on removal.
• Install URL hijacked to gameograf.com — user immediately redirected to third-party site on install.
• Privacy policy is Google's generic policy (not scoped to this extension) but admits data collection and third-party sharing — scores as +10.0.
• New-tab override + search permission: extension controls default search surface and new-tab for all users.
• Free-webmail developer (gmail) with no verified business identity; extension is a game-portal shell pattern targeting popular brand (Avengers).

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com with UTM params branding 'ovkas'; traffic harvesting on removal.
• install_url_hijack crx onInstalled opens gameograf.com with UTM params; user redirected to 3rd-party game portal immediately.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab with extension UI.
• generic_privacy_policy store Policy URL is Google's own privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email halilibrahimseker125@gmail.com; no verified business domain; numbered-alias pattern.
• game_portal_shell crx js_external_hosts includes gameograf.com alongside google, instagram, netflix, youtube, x.com — classic portal shell.
• search_permission_newtab_combo manifest 'search' permission + newtab override enables full control of user's search surface.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.

Permissions Breakdown

• search medium Allows overriding default search provider; combined with NewTab override amplifies monetization risk.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary vector for traffic and ad monetization.

Pillar Scores

Bookkeeping