Top Risks

• Uninstall and install URL both hijack to gameograf.com — classic traffic-monetization shell pattern.
• Privacy policy is Google's generic account policy, not scoped to this extension; admits data collection + 3rd-party sharing.
• NewTab override with search permission and links to Instagram, Netflix, YouTube, X — ad-monetization aggregator shape.
• Free-webmail developer (gmail), no verified publisher, no business domain — unverifiable identity.
• No CSP defined (MV3 default applies) but extension contacts 6 external hosts including off-topic social/media platforms.

Evidence

• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=ovkas — traffic-monetization redirect on install.
• uninstall_url_hijack crx setUninstallURL points to https://gameograf.com/?utm_source=ovkas — monetization shell signal.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab for all users.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_dev store Developer email halilseker3455@gmail.com — free webmail, no verified business domain.
• js_external_hosts crx Extension contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — broad off-topic reach.
• webstore_new_tab_monetization store NewTab + search permission + install/uninstall hijack to ad-traffic domain = monetization shell pattern.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP declared.

Permissions Breakdown

• search medium Allows reading/overriding search queries; medium risk especially paired with NewTab override.
• chrome_url_overrides.newtab medium Replaces every new tab — high-visibility surface for monetization and data capture.

Pillar Scores

Bookkeeping