Top Risks

• Uninstall AND install URL both hijack to gameograf.com with UTM tracking — classic monetization shell pattern.
• NewTab override with 'search' permission = search hijack surface; privacy policy URL is unfetchable Google account page.
• Free-webmail dev (gmail) with no business website; no verified publisher — accountability gap.
• Privacy policy fetched=false (SSL error on Google account URL) — effectively no scoped policy for this extension.
• JS contacts gameograf.com plus major social/streaming sites (instagram, netflix, youtube, x.com) from NewTab page.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → gameograf.com with ovkas UTM params; clear monetization redirect.
• install_url_hijack manifest onInstalled opens gameograf.com with same UTM params — tracks installs for affiliate/monetization.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab for ad/search monetization.
• privacy_policy_fetch_failure crx privacy_policy_classification.fetched=false, SSLError on Google account URL — no scoped policy exists.
• free_webmail_dev store Developer email poyrazkareyel735@gmail.com; no business domain; no verified publisher badge.
• js_external_hosts crx NewTab JS loads/contacts gameograf.com, instagram, netflix, youtube, x.com — broad external reach.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension with external host contacts.
• search_permission_plus_newtab manifest 'search' permission + newtab override is canonical search-hijack combo in monetization shells.

Permissions Breakdown

• search medium Allows manipulation of Chrome search settings; paired with newtab override raises monetization risk.
• chrome_url_overrides.newtab high Replaces new-tab page; primary vector for ad-monetization and search hijacking in shell extensions.

Pillar Scores

Bookkeeping