Top Risks

• Uninstall URL hijack to gameograf.com game-portal with UTM tracking — classic monetization shell.
• Install URL hijack to same gameograf.com — opens 3rd-party on install.
• Privacy policy is Google's own policy (scope_extension=false, data_collection=true, third_party_sharing=true) — generic, admits broad sharing, not scoped to this extension.
• NewTab override combined with search permission and free-webmail dev = high redirect/monetization risk.
• Free-webmail developer (gmail), no verified publisher, no business website, numbered alias in email.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com with OVKAS UTM params; game-portal monetization pattern.
• install_url_hijack crx onInstalled opens gameograf.com with same UTM params — 3rd-party install redirect.
• newtab_override manifest chrome_url_overrides.newtab = index.html; NewTab replaced with wallpaper/game-portal shell.
• privacy_policy_generic store Policy URL is Google's own account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_dev store Developer email halilseker3455@gmail.com — free webmail, numbered alias, no business domain.
• js_external_hosts crx Extension references gameograf.com + 5 major sites (google, instagram, netflix, youtube, x.com) as JS hosts.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.
• no_verified_publisher store Not verified, not featured by Google; 211 installs, 0 ratings.

Permissions Breakdown

• search medium Allows overriding search provider; medium risk on its own but paired with newtab override.
• chrome_url_overrides.newtab high Replaces new-tab page; core monetization surface for ad/redirect injection.

Pillar Scores

Bookkeeping