Top Risks

• Uninstall URL hijack redirects to yowgames.com with UTM tracking — classic monetization shell signal.
• Install URL hijack opens yowgames.com on install — traffic-monetization pattern.
• Privacy policy admits data collection and third-party sharing but is NOT scoped to this extension.
• Developer is free-webmail Gmail with no verified publisher badge and no recognizable business identity.
• Content script runs on all URLs despite minimal stated functionality, maximizing reach.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL targets yowgames.com with UTM params — explicit traffic monetization.
• install_url_hijack manifest onInstalled opens yowgames.com with UTM params — classic install-hijack monetization pattern.
• privacy_policy_generic store Policy at yowgames.com admits data collection + third-party sharing; scope_extension=false.
• free_webmail_developer store Developer email uralsinem026@gmail.com; no verified publisher; no recognized org.
• content_scripts_broad manifest Content script matches *://*/* — runs on every page the user visits.
• no_csp manifest content_security_policy is null; MV3 provides defaults but no explicit hardening declared.
• js_external_hosts crx Extension references yowgames.com and chrome.google.com as external JS hosts.
• maintenance_stale store 9 months since last update — falls in 6–12 month band (+3.5 maintenance score).

Permissions Breakdown

• storage low Used to persist cursor preference selections; low risk in isolation.
• content_scripts *://*/* medium Content script injected on every site; broad reach even without host_permissions declared.

Pillar Scores

Bookkeeping