Top Risks

• Uninstall URL hijack routes to gameograf.com ad-campaign — confirmed monetization shell pattern
• Install URL hijack to same ad-campaign domain on every install event
• NewTab override + search permission = full search-traffic monetization capability
• Privacy policy URL returns fetch error (unfetchable); no effective data-handling disclosure
• Free-webmail dev (gmail), no developer name, no verifiable business identity

Evidence

• uninstall_url_hijack manifest setUninstallURL targets gameograf.com with UTM campaign params — classic monetization shell uninstall redirect.
• install_url_hijack manifest onInstalled opens gameograf.com with same UTM params — ad-traffic acquisition on every install.
• newtab_override manifest chrome_url_overrides.newtab set to index.html; combined with 'search' permission enables search hijacking.
• privacy_policy_unfetchable api ovkas.com/privacy-policy/ returns HTTPError; policy cannot be evaluated — treated as no policy.
• free_webmail_no_dev_name store Developer email halilseker3455@gmail.com, developer_name empty — no verifiable business identity.
• js_external_hosts_social crx Extension contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — broad social/media reach from wallpaper.
• verified_publisher store Verified publisher badge present, but 0c cap applies: monetization hits (gameograf.com) limit discount to -1.0.
• game_portal_shell store gameograf.com is a game portal domain; uninstall+install hijack pattern matches game-portal shell fingerprint.

Permissions Breakdown

• search medium Allows manipulation of search queries/provider; paired with newtab override is a monetization vector.
• chrome_url_overrides.newtab high Replaces every new tab with extension-controlled page; core mechanism for search-traffic hijacking.

Pillar Scores

Bookkeeping