Top Risks

• Privacy policy URL unreachable (fetch error) — no data handling disclosure available.
• Uninstall and install URL hijack flags set — potential redirect/analytics abuse on install/remove.
• 4 moderate CVEs in bundled jquery@2.1.3 (XSS); no CSP present amplifies risk.
• Extension loads JS from raw.githubusercontent.com — remote code supply-chain risk.
• Extension stale at 24 months with unpatched vulnerable libraries and no CSP.

Evidence

• install_url_hijack + uninstall_url_hijack both true crx Extension sets install/uninstall URL hooks; targets null but flags are set — monetization/tracking vector.
• jquery@2.1.3 bundled with 4 moderate CVEs crx CVE-2019-11358, CVE-2020-11022, CVE-2020-11023, CVE-2015-9251 — all XSS, none patched in 2.1.3.
• csp_present == false, MV3 manifest No content_security_policy declared; amplifies jQuery XSS CVE risk per v2 jquery+no-CSP rule.
• js_external_hosts includes raw.githubusercontent.com crx Contacts GitHub raw content CDN — remote code loading supply-chain risk.
• privacy policy fetch failed api fetch_error:ConnectionError on https://play.gameograf.com/privacy — policy inaccessible, scored as no policy.
• months_since_update == 24 store Last updated September 2024; 24 months stale — 6-12 month bucket (+3.5 maintenance) with CVEs unpatched.
• developer_name empty, no Offered-by store No developer display name in listing; email info@gameograf.com is only identity signal.
• verified_publisher == true store Verified publisher badge present; discount applied to reputation but capped due to stale+CVEs.

CVE Exposures (4)

Pillar Scores

Bookkeeping