Top Risks

• Uninstall URL hijack redirects users to gameograf.com ad/tracking domain with UTM attribution.
• Install URL hijack immediately sends users to gameograf.com on install.
• New-tab override replaces default tab with developer-controlled page enabling search monetization.
• Privacy policy is Google's generic account policy — does not scope to this extension; admits data collection and 3rd-party sharing.
• Free-webmail developer (gmail) with no business website and only 8 installs — low accountability, high option value for future misuse.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL points to gameograf.com with UTM ovkas campaign params.
• install_url_hijack manifest onInstalled opens gameograf.com with matching UTM params — immediate traffic monetization on install.
• newtab_override manifest chrome_url_overrides.newtab set to index.html — all new tabs served by extension.
• privacy_policy_generic store Policy URL is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true) — D v3.5 → +10.0.
• free_webmail_developer store Developer email gayeatakul4@gmail.com; no business domain; no verified publisher badge.
• js_external_hosts_monetization_shape crx Extension contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — game-portal + major platforms pattern.
• sibling_install_uninstall_url api install_url and uninstall_url each match 3 other extensions in store — coordinated operator cluster.
• no_csp manifest content_security_policy is null (csp_present=false); MV3 default applies but no explicit hardening.

Permissions Breakdown

• search medium Allows search-provider interaction; low standalone risk but paired with newtab override signals monetization intent.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary vector for search-monetization and traffic hijacking.

Pillar Scores

Bookkeeping