Top Risks

• Uninstall AND install URL hijack both redirect to gameograf.com ad-campaign URLs — classic traffic-monetization shell.
• NewTab override with search permission routes all new-tab traffic through developer-controlled page.
• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• Free-webmail developer (gmail) with no verified business identity; gameograf.com operator cluster shares install/uninstall URLs with 4 sibling extensions.
• Extension contacts 6 external JS hosts (Instagram, Netflix, YouTube, X, Google, gameograf.com) with no CSP despite MV3.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com with utm_source/medium/campaign=ovkas; monetization fingerprint.
• install_url_hijack crx onInstalled opens gameograf.com with identical UTM params; double-hijack pattern.
• newtab_override manifest chrome_url_overrides.newtab = index.html replaces every new tab with developer-controlled page.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0.
• operator_cluster_siblings api install_url and uninstall_url dimensions each share 4 siblings; same gameograf.com operator cluster.
• free_webmail_dev store Developer email poyrazkareyel735@gmail.com; no verified business; reputation floor 7.5 applied.
• js_external_hosts crx 6 external hosts: gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com; no CSP.
• new_tab_monetization_pattern store NewTab + search override + install/uninstall hijack + ad-UTM URL = textbook traffic-monetization shell.

Permissions Breakdown

• search medium Allows reading/manipulating search queries; combined with newtab override amplifies risk.
• chrome_url_overrides.newtab high Replaces new-tab page; primary monetization vector for traffic-redirect shells.

Pillar Scores

Bookkeeping