Top Risks

• Uninstall and install URL hijack both redirect to gameograf.com with UTM tracking — confirmed monetization shell pattern.
• NewTab override replaces every new tab; combined with search permission creates full search-traffic monetization surface.
• Privacy policy is Google's generic policy — scope_extension==false, data_collection==true, third_party_sharing==true; scored +10.0.
• JS contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — 6 external hosts across unrelated origins with no stated purpose.
• No developer name listed; manifest uses __MSG__ placeholders obscuring true app identity.

Evidence

• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=ovkas — confirmed install redirect to 3rd-party ad/game portal.
• uninstall_url_hijack crx setUninstallURL points to https://gameograf.com/?utm_source=ovkas — confirmed uninstall redirect to 3rd-party portal.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab replaced by extension page.
• generic_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• js_external_hosts crx 6 external JS hosts: gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com — wide unrelated reach.
• no_developer_name store developer_name field is empty; manifest uses __MSG_appName__ placeholder; true publisher identity obscured.
• no_csp manifest content_security_policy is null / csp_present=false on MV3 extension with newtab override.
• verified_publisher store verified_publisher=true but discount capped by generic privacy policy (data_collection+third_party_sharing admitted, scope_extension=false).

Permissions Breakdown

• search medium Allows override of search provider; medium risk on its own but paired with newtab override elevates concern.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; primary monetization surface for traffic hijack.

Pillar Scores

Bookkeeping