Top Risks

• NewTab override combined with uninstall/install URL hijacks — confirmed monetization shell pattern.
• Privacy policy points to generic Google policy; fetch failed (SSLError) — no scoped policy exists.
• Operator cluster of 5+ siblings under same fingerprint (13 by dev email, 21 by install URL) — factory-produced extension.
• innerHTML DOM-XSS sink in popup.js with no CSP — exploitable if content is user/network-controlled.
• 15 months since last update with newtab override active across all users.

Evidence

• uninstall_url_hijack manifest setUninstallURL targets https://gameograf.com/?utm_source=gameograf — traffic monetization on uninstall.
• install_url_hijack manifest onInstalled opens https://gameograf.com/?utm_source=install — confirms monetization shell pattern.
• operator_cluster api 5 compound siblings, 13 by dev email, 21 by install URL — factory-produced extension cluster.
• privacy_policy_generic store Policy URL is Google's own account policy; fetch failed SSLError; no extension-scoped policy exists.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html — replaces every new tab, high reach monetization surface.
• dom_sink_innerhtml_userctrl crx js/popup.js: innerHTML assigned from variable with no CSP — DOM-XSS risk.
• no_csp manifest content_security_policy is null; MV3 default applies but dom_sink + no explicit CSP raises XSS risk.
• stale_newtab store 15 months since update, newtab override active — stale high-reach surface with monetization URLs.

Permissions Breakdown

• search medium Allows querying browser search functionality; medium risk in context of NewTab override.
• host_permissions: https://api.gameograf.com/* medium Scoped to developer's own API domain; low inherent risk but enables data exfil to dev backend.
• chrome_url_overrides.newtab medium Replaces every new tab — high reach, monetization surface, search-redirect opportunity.

Pillar Scores

Operator Siblings (13)

Other extensions sharing this developer's compound fingerprint:

• kenndofkbpgkfhaecjmnjmehhhbnioeh
• ieepfmpmjnjidennkopcbamjjdemhjcf
• chjbfnbpbgjnofhahgblpcifjcbkolcp
• bpicplogeibhabicoedobpchdkngbhjh
• jmokcnonladmkkdlgbalffkjiogfcgha
• cfbobdhebljlbkhdhnikebhhijocphfo
• ckcailiifgopnblmaeaefimdgnaelcph
• dpkgeginpcjfcgnjicpkfkkbnpailidn
• hmagnnippelpfgkmbdnepolcgjlmbohh
• jimikjehahhdekhbmhpbmbponjcimajc
• jofgjibhmlaeofgmidllemkckkpgnpbd
• iimgbphfdpnahafdmikdjnpfnffnbkcl
• gafbkkfalgndkoilabfhmjjjgeihboed

Bookkeeping