Top Risks

• Privacy policy admits data collection and 3rd-party sharing with no extension-level scope — maximum privacy risk score.
• Uninstall URL hijack and install URL hijack both active; behavioral monetization signals present.
• Extension stale ~20 months; future ownership transfer or silent update risk elevated at 100K installs.
• Generic/unscoped privacy policy means users have no clarity on what game telemetry is shared with third parties.
• 100K user install base provides meaningful blast radius if extension is repurposed or sold.

Evidence

• privacy_policy_generic api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → triggers +10.0 privacy (v3.5 rule D).
• uninstall_url_hijack crx chrome.runtime.setUninstallURL points to gamebol.com/extreme-car-traffic-racing/ — first-party domain, not ad-tech.
• install_url_hijack crx onInstalled opens /Game_Source/index.html per install_url_hijack=true.
• maintenance_stale store Last updated October 2023, ~20 months ago; +6.0 maintenance band (12-24mo).
• verified_publisher_featured store verified_publisher=true AND is_featured_by_google=true; Reputation floor 2.0 applied.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0, cve_findings_raw empty — code quality pillar 0.0.
• no_permissions manifest permissions[] and host_permissions[] both empty; no dangerous capabilities declared.
• webstore_uninstall_redirect store Uninstall URL set (+3.0 webstore); 100K installs (+1.0+1.0); install URL hijack (+2.0) = 7.0, capped at 10.

Pillar Scores

Bookkeeping