Top Risks

• Uninstall AND install URL both hijack to gameograf.com affiliate tracker — confirmed monetization shell pattern.
• Privacy policy is Google's own generic policy (scope_extension=false, data_collection=true, third_party_sharing=true) — scores +10 privacy.
• NewTab override replaces every new tab; combined with search permission enables full search/browsing monetization.
• Extension contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com from JS — 5 unrelated external hosts.
• No CSP on MV3 extension with external JS hosts including social and streaming platforms.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL -> gameograf.com with utm_source=ovkas; clear affiliate monetization.
• install_url_hijack crx onInstalled opens gameograf.com with utm tracking; install hijack confirmed.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab replaced.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension.
• external_js_hosts crx JS contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — unrelated platform cluster.
• no_csp manifest content_security_policy is null on MV3 extension with multiple external JS hosts.
• search_permission manifest search permission declared alongside newtab override — search monetization pattern.
• brand_theme_shell store Title uses Barbie brand as theme wallpaper shell; low-effort traffic-monetization pattern.

Permissions Breakdown

• search medium Allows overriding search provider; paired with newtab override is a search-hijack vector.
• chrome_url_overrides.newtab medium Replaces every new tab with extension page; primary monetization surface for this category.

Pillar Scores

Bookkeeping