Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Moon cat [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall and install URL hijack to gameograf.com tracking URL — classic monetization shell pattern.
• NewTab override combined with 'search' permission enables search monetization and traffic diversion.
• Developer name (dekuy.com) differs from email domain (gameograf.com) — split-identity pattern obscures accountability.
• No CSP; innerHTML DOM-XSS sinks in popup.js and calendar.js without sanitization guard.

Evidence

• uninstall_url_hijack manifest setUninstallURL targets https://gameograf.com/?utm_source=dekuy&utm_medium=dekuy — 3rd-party tracking on removal.
• install_url_hijack manifest onInstalled opens https://gameograf.com/?utm_source=dekuy&utm_medium=dekuy — affiliate redirect on install.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html replaces every new tab for monetization reach.
• search_permission manifest Declared 'search' permission alongside newtab override — enables search suggestion hijack.
• dom_xss_sink crx innerHTML assignments from variables in popup.js and calendar.js with no CSP guard — DOM-XSS risk.
• split_developer_identity store Developer name 'dekuy.com' vs email 'support@gameograf.com' — two separate domains obscure ownership.
• no_content_security_policy manifest csp_present=false on MV3; DOM sinks and external JS hosts increase XSS exposure.
• privacy_policy_classification api Policy fetched, scoped, data_collection=true, retention=true, third_party_sharing=true — adequate but permissive.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Moon cat [adware] + malext.io malicious_extension_sentry; score 4.20 -> 6.70 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding search suggestions; paired with newtab override raises monetization risk.
• https://api.gameograf.com/* medium Host permission scoped to developer's own API domain for data retrieval.
• chrome_url_overrides.newtab medium Replaces new-tab page; significant hijack surface and monetization vector.

Pillar Scores

Bookkeeping