Top Risks

• Uninstall URL hijack to yowgames.com — classic monetization/tracking shell pattern (+3.0 webstore).
• Install URL hijack to yowgames.com with UTM tracking on every fresh install (+2.0 webstore).
• Privacy policy fetched but not scoped to this extension; admits data collection and third-party sharing (+10.0 privacy).
• Free-webmail developer (uralsinem026@gmail.com) with no verified business identity raises accountability risk.
• Content script injected on *://*/* gives broad page-read reach across every site user visits.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → yowgames.com with UTM params; monetization shell signal.
• install_url_hijack manifest onInstalled opens yowgames.com with UTM tracking; unsolicited third-party navigation.
• content_scripts_broad manifest content_scripts_matches: ['*://*/*'] — injects into every HTTP/HTTPS page.
• free_webmail_dev store Developer email uralsinem026@gmail.com; no verified business domain; domain_age_ct not queried.
• privacy_policy_not_scoped api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → generic site policy.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit extension CSP declared.
• jquery_3.6.0_bundled crx jquery 3.6.0 detected; no CVEs found in cve_findings_raw for this version.
• js_external_hosts crx Contacts chrome.google.com and yowgames.com; yowgames is operator domain tied to monetization redirects.

Permissions Breakdown

• storage low Used to persist cursor selection preferences; low standalone risk.
• content_scripts *://*/* high Injects JS/CSS into every page visited; broad reach despite narrow declared permissions.

Pillar Scores

Bookkeeping