Top Risks

• NewTab override + uninstall/install URL hijack to gameograf.com — classic ad-monetization shell pattern.
• Privacy policy is Google's own policy (not scoped to this extension), admits data collection & 3rd-party sharing — scored +10.
• Install and uninstall redirect hooks send UTM-tagged traffic to developer domain on every install/uninstall event.
• No CSP present on MV3 extension with DOM-XSS sink (innerHTML) in calendar.js.
• Developer name (dekuy.com) differs from email domain (gameograf.com) — split-identity pattern common in wallpaper/newtab shells.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — hijacks every new tab page.
• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?utm_source=dekuy&utm_medium=dekuy
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=dekuy&utm_medium=dekuy
• privacy_policy_generic store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension with innerHTML sink.
• developer_identity_mismatch store developer_name=dekuy.com, email=support@gameograf.com — two distinct domains for same publisher.
• dom_xss_sink crx js/calendar.js: gridEl.innerHTML = html (user-controlled variable, no CSP guard).
• search_permission_newtab_combo manifest search permission combined with newtab override enables search provider monetization.

Permissions Breakdown

• search medium Allows reading/modifying search queries; paired with newtab override raises hijack concern.
• newtab override (chrome_url_overrides) high Replaces every new tab — primary mechanism for search/ad monetization shells.
• host_permissions: https://api.gameograf.com/* medium Scoped to developer API; enables data exfil to developer-controlled endpoint.

Pillar Scores

Bookkeeping