Top Risks

• Uninstall + install URL both hijack to gameograf.com affiliate funnel — confirmed monetization shell.
• NewTab override contacts gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com — 6 external hosts with no stated reason.
• Privacy policy is Google's own policy (not scoped to this extension) and admits data collection + 3rd-party sharing.
• No CSP on MV3 extension with 6 external JS hosts increases injection/exfil surface.
• Fan-content/theme shell pattern (anime wallpaper wrapping ad-monetization newtab).

Evidence

• uninstall_url_hijack crx setUninstallURL → gameograf.com with ovkas UTM params; clear affiliate monetization.
• install_url_hijack crx onInstalled opens gameograf.com; same affiliate funnel as uninstall URL.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab served by this extension.
• external_hosts crx 6 JS external hosts: gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com.
• privacy_policy_generic store Policy URL is Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• no_csp crx content_security_policy is null; no CSP despite 6 external hosts.
• fan_theme_shell store Anime/JJK wallpaper theme wrapping ad-monetization newtab — fan-content shell pattern.
• search_permission_newtab_combo manifest 'search' permission + newtab override is classic search-monetization pattern.

Permissions Breakdown

• search medium Allows reading/overriding search queries; combined with newtab override elevates monetization risk.
• chrome_url_overrides.newtab medium Replaces every new tab page; primary vector for ad/affiliate monetization.

Pillar Scores

Bookkeeping