Top Risks

• Uninstall URL hijacks to gameograf.com with UTM tracking — classic monetization shell pattern.
• Install URL also hijacks to gameograf.com; monetization intent on both install and uninstall.
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• NewTab override with external contacts to social/streaming domains (Instagram, Netflix, YouTube, X) beyond wallpaper function.
• Free-webmail developer (Gmail), no verified publisher, no business domain — unaccountable identity.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com with UTM params; clear monetization shell.
• install_url_hijack crx onInstalled opens gameograf.com; dual-hijack pattern strongly indicates traffic monetization.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab for ad/affiliate exposure.
• privacy_policy_generic store Policy is Google Account policy (scope_extension=false, data_collection=true, third_party_sharing=true). +10.0 privacy.
• free_webmail_developer store Developer email halilseker3455@gmail.com; no business website; unverified identity.
• js_external_hosts crx Extension contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — 6 external hosts.
• new_tab_monetization_override manifest NewTab + uninstall/install hijack + external ad-domain = game-portal/monetization shell fingerprint.
• no_csp crx content_security_policy is null; no CSP declared in MV3 extension.

Permissions Breakdown

• search medium Allows reading and potentially overriding search queries; medium risk for a NewTab shell.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary monetization vector for this category.

Pillar Scores

Bookkeeping