Top Risks

• Uninstall URL hijacks to gameograf.com ad-tech domain — classic monetization shell pattern.
• Privacy policy URL unreachable (ConnectTimeout); treated as no policy — score 10.0.
• NewTab override + search permission = full search monetization surface on every new tab.
• Free-webmail dev email (gmail), no verified publisher, privacy domain unresolvable.
• 7 external JS hosts including goo.gl and gameograf.com with no CSP to constrain them.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → https://gameograf.com/?utm_source=dekuy — 3rd-party ad-tech redirect on uninstall.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab served by extension with search permission.
• privacy_policy_unreachable api fetch_error:ConnectTimeout on https://dekuy.com/privacy-policy/ — policy cannot be evaluated; scored as missing.
• free_webmail_dev store Developer email hesapikinci020@gmail.com — numbered-alias gmail, no verified publisher, no business domain.
• external_js_hosts crx 7 external hosts: dekuy.com, gameograf.com, goo.gl, getbootstrap.com, github.com, popper.js.org, www.charistheo.io.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP hardening with 7 external JS hosts.
• new_tab_monetization_pattern store NewTab override + uninstall hijack to gameograf.com = textbook new-tab monetization shell.
• install_url_hijack crx onInstalled opens index.html (internal), low additional risk but confirms install-hook pattern.

Permissions Breakdown

• search medium Allows querying the browser search API; medium risk as paired with newtab override for search monetization.
• chrome_url_overrides.newtab high Replaces every new tab; high reach monetization surface used with gameograf.com redirect.

Pillar Scores

Bookkeeping