Top Risks

• Uninstall and install URL hijacks redirect to gameograf.com UTM-tracked pages — classic monetization shell.
• Privacy policy points to generic Google policy page; failed to fetch; no extension-scoped disclosure → privacy pillar max.
• NewTab override + search permission = search-monetization surface on every new tab for 280 users.
• Months since update = 15; stale for a newtab extension with active outbound API calls.
• No developer name listed despite verified publisher badge; reduced accountability.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → https://gameograf.com/?utm_source=gameograf&utm_medium=link&utm_campaign=bg&utm_content=uninstall
• install_url_hijack manifest onInstalled opens https://gameograf.com/?utm_source=install&utm_medium=link&utm_campaign=bg&utm_content=install
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; replaces every new-tab page.
• privacy_policy_unfetchable api Policy URL points to myaccount.google.com/privacypolicy; fetch failed SSLError; no extension-specific scope.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit policy declared.
• verified_publisher_stale store Verified publisher but months_since_update=15 (>12mo); 0c cap applies, discount capped at -1.0.
• no_developer_name store developer_name is empty string; no 'Offered by' identity visible.
• outbound_api crx js_external_hosts includes api.gameograf.com and www.google.com; extension phones home on every newtab load.

Permissions Breakdown

• search medium Allows reading/modifying search queries; paired with newtab override amplifies search-monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab — high-reach monetization surface; paired with search permission signals ad-tech intent.
• host_permissions: https://api.gameograf.com/* low Scoped to dev-controlled domain; limits arbitrary exfil but still an outbound channel.

Pillar Scores

Bookkeeping