Top Risks

• Uninstall AND install URL both hijack to gameograf.com — clear traffic-monetization shell pattern.
• NewTab override redirects every new tab; extension contacts social/streaming giants (YouTube, Netflix, Instagram, X).
• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• No content security policy (MV3 default still absent in manifest); JS contacts 6 external hosts.
• Low install count (204), no ratings, fan-content/anime-theme shell with UTM-parameterised game portal.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → https://gameograf.com/?utm_source=ovkas (3rd-party game portal with UTM)
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=ovkas — monetization on install event
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab served by extension
• js_external_hosts crx 6 external hosts: gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com
• privacy_policy_generic store Policy is Google's account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true
• fan_content_shell store Anime wallpaper theme with game-portal monetization URLs; 204 installs, 0 ratings — low-effort shell.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension with external JS hosts
• search_permission_plus_newtab manifest search permission combined with newtab override enables search provider capture for ad revenue

Permissions Breakdown

• search medium Allows overriding search provider; paired with newtab override, enables search monetization.
• chrome_url_overrides.newtab medium Hijacks every new tab; primary mechanism for traffic monetization and ad injection.

Pillar Scores

Bookkeeping