Top Risks

• Uninstall URL hijack to yowgames.com with UTM tracking — classic monetization shell signal.
• Install URL hijack to yowgames.com — tracks installs via third-party affiliate parameters.
• Privacy policy (yowgames.com) admits data collection and third-party sharing but has no extension-specific scope — scores max privacy risk.
• Free-webmail dev email (gmail) with no verified business identity; policy domain differs from dev identity.
• Content script runs on all URLs (*://*/*) giving broad page-level reach with no CSP constraint.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → yowgames.com with UTM params; textbook monetization redirect.
• install_url_hijack manifest onInstalled opens yowgames.com with UTM tracking; monetization shell pattern.
• privacy_policy_generic store Policy fetched at yowgames.com: scope_extension=false, data_collection=true, third_party_sharing=true → max privacy score.
• free_webmail_dev store Developer email ayseozkacar237@gmail.com; numbered alias pattern; no verified business.
• content_script_all_urls crx content_scripts_matches=[*://*/*] with no host_permissions; runs on every site user visits.
• no_csp crx content_security_policy is null; MV3 default applies but no explicit restriction declared.
• js_external_host_yowgames crx Extension contacts yowgames.com — same domain as install/uninstall hijack target.
• privacy_policy_domain_mismatch store Policy hosted on yowgames.com; dev email is gmail.com; no domain ownership verified.

Permissions Breakdown

• storage low Stores cursor preferences locally; low standalone risk.
• content_scripts *://*/* high Injects JS into every page visited; broad reach despite low declared permissions.

Pillar Scores

Bookkeeping