Top Risks

• Uninstall URL hijack redirects to yowgames.com with UTM tracking — monetization shell pattern.
• Install URL hijack opens yowgames.com on install — traffic monetization on every install event.
• Privacy policy (yowgames.com) is not scoped to this extension but admits data collection and third-party sharing — +10 privacy pillar.
• Free-webmail developer email (gmail) with no verified publisher status reduces accountability.
• Content script runs on all URLs giving broad page-level reach despite minimal declared permissions.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → yowgames.com with UTM params; classic monetization shell.
• install_url_hijack manifest onInstalled opens yowgames.com with UTM params; drives traffic on every install.
• privacy_policy_generic store Policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true → +10 privacy.
• free_webmail_developer store Developer email busrakaraman256@gmail.com; no verified publisher; reputation floor 6.5.
• content_scripts_broad manifest content_scripts_matches: *://*/* — runs on every HTTP/HTTPS page.
• csp_absent_mv3 manifest csp_present=false; MV3 has strict default but no explicit CSP declared.
• js_external_hosts crx Extension contacts chrome.google.com and yowgames.com externally.
• no_cve_findings crx jquery@3.6.0 bundled; cve_findings_raw empty — no known CVEs flagged.

Permissions Breakdown

• storage low Stores cursor preferences locally; low standalone risk.
• content_scripts *://*/* medium Runs JS on every page; paired with broad match pattern increases reach.

Pillar Scores

Bookkeeping