Top Risks

• NewTab override + uninstall/install URL hijack to gameograf.com — classic traffic-monetization shell pattern.
• Privacy policy URL unreachable (fetch_error) — effectively no privacy disclosure; pillar scores 10.
• DOM-XSS sinks (innerHTML) in popup.js and calendar.js with no CSP, amplifying risk.
• Developer name blank; no 'Offered by' identity increases accountability gap.
• MV3 + no CSP: CSP not declared, innerHTML sinks unmitigated.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html — replaces every new tab page.
• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?utm_source=extension&utm_medium=install
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install
• privacy_policy_fetch_error api Policy URL https://api.gameograf.com/gameograf-privacy-policy.html returned ConnectionError.
• dom_xss_sink_no_csp crx innerHTML sinks in popup.js and calendar.js; csp_present=false, no mitigation.
• no_developer_name store developer_name is empty string — no 'Offered by' identity in store listing.
• verified_publisher store verified_publisher=true for gameograf.com (domain age 2051 days, 265 certs).
• js_external_hosts_broad crx 12 external JS hosts including api.gameograf.com plus multiple google.com subdomains.

Permissions Breakdown

• search medium Allows interaction with the browser search API; medium risk for a NewTab override.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; low blast radius but fetches policy from same host.
• chrome_url_overrides: newtab medium Replaces new tab page — prime monetization and data-collection surface.

Pillar Scores

Bookkeeping