Top Risks

• Uninstall and install URL hijacks redirect users to yowgames.com with UTM tracking — monetization shell pattern.
• Privacy policy not scoped to this extension; admits data collection and third-party sharing (D-clause → +10.0).
• Free-webmail developer (gmail) with no verified publisher or business identity; domain_age_ct skipped.
• Content script injected on *://*/* gives broad DOM access across all visited sites.
• Privacy policy hosted on yowgames.com but developer email is gmail — developer identity and policy domain mismatch.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL targets yowgames.com with UTM params — monetization redirect on uninstall.
• install_url_hijack manifest onInstalled opens yowgames.com with UTM params — third-party URL opened on install.
• privacy_policy_scope_fail store Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — D-clause applies (+10.0).
• free_webmail_developer store Developer email uralsinem026@gmail.com; free webmail, no verified publisher, no recognized org.
• content_scripts_all_urls manifest content_scripts_matches=[*://*/*] injects JS into every page the user visits.
• no_csp manifest content_security_policy is null; MV3 strict default applies but no explicit CSP declared.
• maintenance_stale store 9 months since last update — 3-6 month bracket (+1.5).
• js_external_hosts crx External JS hosts: chrome.google.com, yowgames.com — yowgames is operator's own domain.

Permissions Breakdown

• storage low Used to persist cursor selection preferences; low-risk standalone.
• content_scripts *://*/* medium Content script injected on all URLs gives DOM read/write access across every site.

Pillar Scores

Bookkeeping