Top Risks

• Uninstall and install URL hijack to gameograf.com — confirmed monetization/redirect shell pattern.
• NewTab override with search permission — every new tab replaced for ad/search revenue.
• Privacy policy URL returns fetch error — no enforceable policy; score treated as unfetched.
• Free-webmail developer (gmail), no developer name, no verified business identity.
• JS external hosts include major platforms (Google, YouTube, Instagram, Netflix, X) alongside gameograf.com — opaque data flows.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → https://gameograf.com/?utm_source=ovkas — 3rd-party redirect on uninstall.
• install_url_hijack manifest onInstalled opens https://gameograf.com/?utm_source=ovkas — 3rd-party redirect on install.
• newtab_override manifest chrome_url_overrides.newtab = index.html — every new tab controlled by extension.
• privacy_policy_fetch_error api privacy_policy_classification.fetched == false (HTTPError) — policy unverifiable; treated as no policy.
• free_webmail_no_dev_name store developer_email halilseker3455@gmail.com; developer_name empty — no verified business identity.
• js_external_hosts_monetization crx JS contacts gameograf.com plus major platforms (YouTube, Netflix, Instagram, X) — monetization aggregator shape.
• verified_publisher store verified_publisher == true; discount capped to -1.0 due to monetization shape (v3.5 invariant 0c/E).
• no_csp manifest content_security_policy is null on MV3 — no explicit CSP declared.

Permissions Breakdown

• search medium Allows interaction with browser search; paired with NewTab override enables search monetization.
• chrome_url_overrides.newtab high Replaces every new tab page — primary attack surface for ad/search monetization.

Pillar Scores

Bookkeeping