Top Risks

• Uninstall and install URL hijack redirect to yowgames.com with UTM tracking — monetization shell pattern.
• Privacy policy is generic yowgames.com policy admitting data collection and third-party sharing; not scoped to this extension.
• Free-webmail developer (gmail) with no verified business identity; domain_age_ct not applicable.
• Content script injected on *://* gives DOM access to every page despite minimal declared permissions.
• MV3 + no CSP: content scripts on all URLs with external JS host (yowgames.com) raises exfil surface.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → yowgames.com with UTM tracking; monetization shell indicator (+3.0 webstore).
• install_url_hijack manifest onInstalled opens yowgames.com UTM URL (+2.0 webstore).
• content_scripts_all_urls manifest content_scripts_matches: *://*/* — runs on every site the user visits.
• privacy_policy_generic store Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (D rule).
• free_webmail_developer store Developer email ayseozkacar237@gmail.com; no verified publisher; no business website (+1.5 rep).
• js_external_host crx yowgames.com listed as external JS host; combined with content_scripts on all URLs raises network risk.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit restriction declared.
• jquery_3_6_0_bundled crx jquery@3.6.0 bundled; no CVEs found in cve_findings_raw; no CVE penalty applied.

Permissions Breakdown

• storage low Stores cursor preference locally; low standalone risk.
• content_scripts *://*/* high Content script runs on every page; can read/modify any page DOM despite no host_permissions declared.

Pillar Scores

Bookkeeping