Top Risks

• Privacy policy is Google's own policy, not scoped to this extension; admits data collection and 3rd-party sharing (+10 privacy).
• Uninstall and install URL hijacks confirmed; redirects to gameograf.com UTM-tracked URLs.
• Operator cluster: 15 siblings by dev email, 23 by install URL — likely wallpaper/NewTab farm.
• NewTab override + search permission = monetization shell pattern with ad-revenue shape.
• DOM-XSS sink (innerHTML from variable) with no CSP present; amplified risk.

Evidence

• install_url_hijack manifest onInstalled opens https://gameograf.com/?utm_source=install&utm_medium=link&utm_campaign=bg (+2.0 webstore).
• uninstall_url_hijack manifest setUninstallURL to https://gameograf.com/?utm_source=uninstall — 3rd-party tracking (+3.0 webstore).
• newtab_override_monetization manifest chrome_url_overrides.newtab = index.html; combined with search permission = monetization shell.
• privacy_policy_generic_google store Policy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, 3rd_party=true → +10.0.
• operator_cluster api 15 siblings by dev_email, 23 by install_url; compound fingerprint sibling_count=3 — wallpaper farm pattern.
• dom_xss_sink_no_csp crx innerHTML from variable in popup.js; csp_present=false amplifies DOM-XSS risk.
• external_host_mlionltd_github_io crx js_external_hosts includes mlionltd.github.io — third-party GitHub-hosted JS not owned by dev.
• maintenance_stale store 16 months since update → +6.0 maintenance pillar score.

Permissions Breakdown

• search medium Allows overriding search provider; typical NewTab monetization vector.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces new-tab page; core monetization surface for wallpaper shells.

Pillar Scores

Operator Siblings (4)

Other extensions sharing this developer's compound fingerprint:

• hpckfgjkocoodghiifpiijpechoimilk
• gimhgipihjkolgkmpffjccnlljanjdcd
• apieggaibpegfepedgdobiphmhpkjlam
• hndiddblhijokmfbhmfgdmeeiddjnbme

Bookkeeping