Top Risks

• Uninstall and install URL hijacks redirect to gameograf.com — classic monetization shell pattern.
• Privacy policy is Google's generic policy; scope_extension=false, data_collection=true, third_party_sharing=true — worst-case Privacy score.
• NewTab override captures every new-tab, paired with 'search' permission enabling search monetization.
• Free-webmail developer (gmail), no developer name, no business domain — unverifiable identity.
• JS contacts gameograf.com, Instagram, Netflix, YouTube, X — 6 external hosts with no stated functional need.

Evidence

• install_url_hijack + uninstall_url_hijack crx Both hooks point to gameograf.com with UTM params — textbook monetization shell; +3.0+2.0 Webstore.
• newtab_override manifest chrome_url_overrides.newtab replaces every new-tab; high-reach capture surface.
• generic_google_privacy_policy store Policy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy.
• free_webmail_no_dev_name store Developer email halilseker3455@gmail.com; developer_name empty; no business domain → Reputation floor 7.5.
• verified_publisher store verified_publisher=true but CAPABILITY GATE applies (newtab override); discount capped at -1.0 per invariant 0c/0b.
• js_external_hosts crx Extension JS contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — 5 unrelated external domains.
• no_csp manifest csp_present=false on MV3 extension; no content_security_policy declared.
• new_tab_monetization_pattern crx NewTab + search permission + gameograf.com hijack URLs = monetization aggregator shell pattern (+2.0 Webstore).

Permissions Breakdown

• search medium Allows querying the browser search API; combined with newtab override this enables search monetization.
• chrome_url_overrides.newtab high Replaces every new-tab page; high-reach capture point for traffic and search monetization.

Pillar Scores

Bookkeeping