Top Risks

• Uninstall and install URL hijack both redirect to gameograf.com — confirmed monetization shell pattern.
• Privacy policy is Google's generic policy (scope_extension=false, data_collection=true, third_party_sharing=true) — worst-case privacy disclosure.
• NewTab override with search permission and external contacts to 6 major platforms (google, youtube, instagram, netflix, x) is a classic ad-aggregator fingerprint.
• Free-webmail developer (halilseker3455@gmail.com) with no verified publisher badge or business website.
• gameograf.com appears in both install/uninstall hijack URLs and js_external_hosts, indicating active traffic exfiltration to operator domain.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com with UTM params; confirmed 3rd-party redirect.
• install_url_hijack crx onInstalled opens gameograf.com with UTM params; install-time traffic monetization.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab captured by extension.
• privacy_policy_generic store Policy URL is Google account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_dev store Developer email halilseker3455@gmail.com; no business domain; not verified publisher.
• js_external_hosts crx Extension contacts gameograf.com plus google, youtube, instagram, netflix, x.com — monetization aggregator pattern.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit restriction on external comms.
• new_tab_monetization crx search permission + newtab override + install/uninstall hijack to gameograf.com = confirmed monetization shell.

Permissions Breakdown

• search medium Allows querying browser search API; combined with newtab override amplifies search-monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; core mechanism for ad/search monetization.

Pillar Scores

Bookkeeping