Top Risks

• Uninstall AND install URL both hijacked to gameograf.com — confirmed monetization shell pattern.
• Minecraft brand impersonation by unverified gmail developer with no confirmed brand ownership.
• New-tab override with 'search' permission enables search-query monetization on every new tab.
• Privacy policy URL is Google's generic account policy; fetch failed (SSLError) — effectively no extension-scoped policy.
• JS external hosts include gameograf.com plus major platforms (YouTube, Netflix, Instagram, X) — broad tracking surface.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → gameograf.com with UTM params; classic monetization shell indicator.
• install_url_hijack manifest onInstalled opens gameograf.com with UTM params; confirms traffic-monetization intent.
• brand_impersonation store brand_mention.is_impersonation=true for 'minecraft'; developer is gmail user 'Ovkas', not Mojang/Microsoft.
• newtab_override manifest chrome_url_overrides.newtab=index.html replaces every new tab page.
• privacy_policy_unfetchable api privacy_policy_classification.fetched=false (SSLError); Google generic URL, not extension-scoped.
• free_webmail_developer store Developer email halilseker3455@gmail.com; no verified publisher, no business domain.
• js_external_hosts crx 6 external JS hosts: gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com.
• no_csp manifest content_security_policy=null (csp_present=false); MV3 default applies but no explicit hardening.

Permissions Breakdown

• search medium Allows reading/overriding search queries; paired with newtab override raises monetization concern.
• chrome_url_overrides.newtab high Replaces every new tab; primary mechanism for ad-monetization shells and search hijack.

Pillar Scores

Bookkeeping