Top Risks

• Newtab hijack redirects every new tab to developer-controlled gameograf.com monetization page.
• Uninstall AND install URL hijack both point to gameograf.com UTM-tagged affiliate URL.
• Privacy policy URL returns fetch error — effectively no accessible privacy policy.
• Free-webmail dev (gmail), no developer name, no verified business identity.
• 7 external JS hosts including instagram.com, netflix.com, x.com — far beyond wallpaper function.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to index.html — every new tab hijacked to developer page.
• uninstall_url_hijack crx setUninstallURL targets gameograf.com with UTM affiliate params (utm_source=ovkas).
• install_url_hijack crx onInstalled opens gameograf.com with same UTM affiliate params — dual hijack pattern.
• privacy_policy_fetch_error api privacy_policy_classification.fetched=false; HTTPError on https://ovkas.com/privacy-policy.
• free_webmail_no_dev_name store Developer email halilseker3455@gmail.com; developer_name empty; no verified business domain.
• external_hosts_mismatch crx 7 JS external hosts: gameograf.com, games.ovkas.com, google.com, instagram.com, netflix.com, youtube.com, x.com.
• new_tab_monetization_shape manifest newtab override + search permission + gameograf.com affiliate links = classic monetization shell.
• verified_publisher store verified_publisher=true but no recognized org; does not offset monetization shell signals.

Permissions Breakdown

• search medium Allows querying the browser search API; combined with newtab override creates search monetization surface.
• chrome_url_overrides.newtab high Replaces every new tab with developer-controlled page; primary vector for ad/affiliate monetization.

Pillar Scores

Bookkeeping