Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection + 3rd-party sharing → +10.0 privacy pillar.
• Uninstall and install URL hijacks redirect users to gameograf.com marketing pages — monetization shell pattern.
• scripting + *://*/*ives capability to inject code into every page the user visits.
• innerHTML DOM-XSS sinks present in main.js with no CSP to mitigate exploitation.
• No developer name listed; developer identity accountability is reduced.

Evidence

• privacy_policy_generic_google store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension; data_collection+third_party_sharing=true.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com UTM-tagged marketing page.
• install_url_hijack crx onInstalled opens gameograf.com UTM-tagged marketing page — monetization signal.
• broad_host_permissions manifest host_permissions=[*://*/*] + scripting permission on Entertainment/cursor extension.
• no_csp manifest content_security_policy is null; no CSP mitigating innerHTML XSS sinks found in code.
• dom_xss_sink crx innerHTML assigned from variable in main.js and main.4964ab1e.js with no CSP — elevated DOM-XSS risk.
• verified_publisher store Verified publisher badge present (gameograf.com resolves); partial reputation credit applied.
• no_developer_name store developer_name is empty string — reduced identity accountability.

Permissions Breakdown

• storage low Standard local data persistence; low standalone risk.
• unlimitedStorage low Extends storage quota; minor risk, pairs with storage.
• scripting high Programmatic script injection into pages; high capability when paired with *://*/*.
• *://*/* (host_permissions) high Broad host access — scripts can run on every page the user visits.

Pillar Scores

Bookkeeping