Top Risks

• Privacy policy URL unreachable (ConnectionError) — effectively no accessible policy for users.
• Extension is 26 months stale with only 270 installs — zombie fingerprint, abandonment risk.
• Uninstall URL hijack registered — redirects users to external page on removal.
• Install URL hijack registered — opens external page on first install.
• No developer name provided; manifest uses MSG placeholders reducing transparency.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() called; target null but hijack flag set — user redirected on uninstall.
• install_url_hijack crx onInstalled opens external URL; target null but hijack flag set — opens page on install.
• privacy_policy_fetch_error api Privacy policy URL https://www.play.gameograf.com/privacy returned ConnectionError — unreachable, treated as no policy.
• maintenance_stale store Last updated July 14 2024; 26 months since update — scores +8.5 maintenance.
• no_developer_name store developer_name is empty string; identity accountability reduced.
• verified_publisher store Extension has verified_publisher=true; applied -3.0 reputation discount (floor 2.0).
• manifest_localization_only manifest manifest_name and manifest_description are MSG placeholders; no inline description visible for review.
• js_external_hosts crx External JS hosts: gameograf.com, www.play.gameograf.com — both on same dev domain, no third-party CDN.

Pillar Scores

Bookkeeping