Top Risks

• Uninstall and install URL both hijack to gameograf.com ad-monetization site with UTM tracking.
• NewTab override with game-portal/monetization shell pattern using free-webmail Gmail dev account.
• Privacy policy is Google's own generic policy — not scoped to this extension but admits data collection and 3rd-party sharing.
• JS external hosts include gameograf.com plus major platforms (Instagram, Netflix, YouTube, X) suggesting traffic aggregation.
• Free-webmail developer with no verified publisher status and no business domain; throwaway-dev fingerprint.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL targets gameograf.com with ovkas UTM params — classic monetization shell.
• install_url_hijack manifest onInstalled opens gameograf.com with same UTM params, confirming traffic-monetization intent.
• newtab_override manifest chrome_url_overrides.newtab set to index.html; every new tab is controlled by this extension.
• generic_privacy_policy store Policy URL is myaccount.google.com/privacypolicy — Google's policy, not scoped to this extension; admits data collection + 3rd-party sharing.
• free_webmail_dev store Developer email yakupsaylan357@gmail.com; no verified publisher, no business domain.
• js_external_hosts crx Extension contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — broad cross-site reach for a wallpaper.
• game_portal_shell crx gameograf.com is a game portal; install/uninstall redirects confirm monetization shell pattern.
• new_tab_monetization_override manifest search permission + newtab override + gameograf.com redirects = textbook search/new-tab monetization cluster.

Permissions Breakdown

• search medium Allows querying the browser search engine; combined with newtab override increases search monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab page; primary monetization surface for this shell pattern.

Pillar Scores

Bookkeeping