Top Risks

• Uninstall AND install URL both hijack to gameograf.com — confirmed monetization shell pattern.
• NewTab override with 'search' permission enables full search-provider hijack.
• Privacy policy URL returns fetch error — effectively no privacy policy.
• Free-webmail dev (gmail), no developer name, no verified business website.
• JS contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — broad unsanctioned external reach.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL -> gameograf.com with ovkas UTM params; confirmed monetization redirect.
• install_url_hijack crx onInstalled opens gameograf.com with same UTM cluster; install-time traffic monetization.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab with extension-controlled page.
• privacy_policy_unfetchable api fetch_error:HTTPError on https://ovkas.com/privacy-policy/ — policy not accessible, treated as absent.
• free_webmail_no_dev_name store Developer is halilseker3455@gmail.com with empty developer_name field and no verified business domain.
• broad_js_external_hosts crx JS contacts 7 external hosts: gameograf.com, games.ovkas.com, google, instagram, netflix, youtube, x.com.
• verified_publisher store Verified publisher badge present but does not mitigate monetization-shell indicators per invariant 0c/E.
• new_tab_monetization_shape manifest NewTab + search override + uninstall/install URL hijack to ad-monetization domain = classic revenue shell.

Permissions Breakdown

• search medium Allows querying browser search; combined with newtab override enables full search hijack.
• chrome_url_overrides.newtab high Replaces new tab page — primary monetization surface for ad/affiliate injection.

Pillar Scores

Bookkeeping