Top Risks

• NewTab override with uninstall+install URL hijack to gameograf.com ad-tracker UTM — monetization shell pattern.
• No developer name listed; manifest uses __MSG__ placeholders obscuring identity.
• Uninstall and install URL hijacks redirect to gameograf.com with tracking params (dekuy UTM).
• innerHTML sinks in popup.js and calendar.js without CSP create DOM-XSS risk.
• Verified publisher discount partially offset by no-CSP MV3 and missing developer name.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → https://gameograf.com/?utm_source=dekuy&utm_medium=dekuy
• install_url_hijack manifest onInstalled opens https://gameograf.com/?utm_source=dekuy&utm_medium=dekuy
• newtab_override manifest chrome_url_overrides.newtab = newtab.html — replaces every new tab.
• no_developer_name store developer_name is empty; manifest_name is __MSG_appName__ placeholder.
• dom_xss_sink crx innerHTML from variable in popup.js and calendar.js; no CSP to mitigate.
• verified_publisher store Verified publisher badge present; caps discount due to monetization pattern.
• privacy_policy api Policy fetched, scoped, data_collection+retention+third_party_sharing all true — adequate.
• csp_absent manifest content_security_policy is null on MV3 extension with innerHTML sinks.

Permissions Breakdown

• search medium Allows overriding search provider — medium monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited reach.
• chrome_url_overrides.newtab medium Replaces new-tab page; high daily-reach monetization surface.

Pillar Scores

Bookkeeping