Top Risks

• NewTab override hijacks every new-tab page; uninstall+install URL redirect to gameograf.com ad-tech site.
• Privacy policy is Google's generic account policy — no extension-scoped data disclosure; classified data_collection+third_party_sharing true without scoping.
• Free-webmail developer (halilseker3455@gmail.com) with no verified business; numbered-alias pattern.
• Extension contacts gameograf.com, Instagram, Netflix, YouTube, X as external JS hosts — broad unexplained reach.
• New-tab monetization shell with UTM-tagged uninstall/install URL hijack confirms traffic-monetization intent.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → gameograf.com with ovkas UTM params; clear ad-traffic monetization.
• install_url_hijack manifest onInstalled opens gameograf.com with same UTM params on every install.
• newtab_override manifest chrome_url_overrides.newtab = index.html replaces every new-tab page.
• generic_privacy_policy store Policy URL is Google's account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_dev store Developer email halilseker3455@gmail.com — numbered alias, no verified business domain.
• js_external_hosts crx Extension references gameograf.com, instagram.com, netflix.com, youtube.com, x.com externally.
• search_permission_newtab manifest search permission combined with newtab override — search-provider monetization pattern.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.

Permissions Breakdown

• search medium Allows overriding search provider; medium monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; prime monetization/redirect surface.

Pillar Scores

Bookkeeping