Top Risks

• Uninstall AND install URL both hijack to gameograf.com: confirmed monetization shell pattern (+6.0 webstore).
• Privacy policy is Google's generic policy (scope_extension=false, data_collection=true, third_party_sharing=true): +10.0 privacy.
• New-tab override with 'search' permission and contacts major platforms (Google, YouTube, Instagram, Netflix, X): traffic-monetization funnel.
• Free-webmail developer (gmail) with no verified publisher, no business website: elevated reputation risk.
• No content-security-policy on MV3 extension with external JS hosts including gameograf.com.

Evidence

• install_url_hijack manifest onInstalled opens https://gameograf.com/?utm_source=ovkas — classic monetization-shell install hijack.
• uninstall_url_hijack manifest setUninstallURL points to https://gameograf.com/?utm_source=ovkas — 3rd-party uninstall redirect.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new-tab with extension content.
• generic_privacy_policy store Privacy URL is Google's own policy (myaccount.google.com/privacypolicy); scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email halilseker3455@gmail.com; no verified publisher badge; no business domain.
• external_js_hosts crx JS contacts gameograf.com, Google, Instagram, Netflix, YouTube, X — 6 distinct domains, 2 countries.
• no_csp manifest content_security_policy is null; MV3 default CSP applies but no explicit policy hardening.
• new_tab_with_search_permission manifest 'search' permission + newtab override = search-monetization funnel pattern even with low install count.

Permissions Breakdown

• search medium Allows querying the search service; combined with newtab override creates search-hijack surface.
• chrome_url_overrides.newtab high Replaces new-tab page with extension-controlled HTML; primary monetization vector for this extension.

Pillar Scores

Bookkeeping