Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Pacman Tribure [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy URL unreachable (fetch error) — no data handling disclosure available.
• Uninstall and install URL hijack flags set — potential redirect/analytics abuse on install/remove.
• 4 moderate CVEs in bundled jquery@2.1.3 (XSS); no CSP present amplifies risk.
• Extension loads JS from raw.githubusercontent.com — remote code supply-chain risk.

Evidence

• install_url_hijack + uninstall_url_hijack both true crx Extension sets install/uninstall URL hooks; targets null but flags are set — monetization/tracking vector.
• jquery@2.1.3 bundled with 4 moderate CVEs crx CVE-2019-11358, CVE-2020-11022, CVE-2020-11023, CVE-2015-9251 — all XSS, none patched in 2.1.3.
• csp_present == false, MV3 manifest No content_security_policy declared; amplifies jQuery XSS CVE risk per v2 jquery+no-CSP rule.
• js_external_hosts includes raw.githubusercontent.com crx Contacts GitHub raw content CDN — remote code loading supply-chain risk.
• privacy policy fetch failed api fetch_error:ConnectionError on https://play.gameograf.com/privacy — policy inaccessible, scored as no policy.
• months_since_update == 24 store Last updated September 2024; 24 months stale — 6-12 month bucket (+3.5 maintenance) with CVEs unpatched.
• developer_name empty, no Offered-by store No developer display name in listing; email info@gameograf.com is only identity signal.
• verified_publisher == true store Verified publisher badge present; discount applied to reputation but capped due to stale+CVEs.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Pacman Tribure [adware] + malext.io malicious_extension_sentry; score 5.37 -> 7.87 (+2.5 cap 2.5).

CVE Exposures (4)

Pillar Scores

Bookkeeping