Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Gets cool Zenitsu Agatsuma [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override + search permission: classic monetization/search-hijack shell pattern with only 16 installs.
• Both install and uninstall URL hijacks redirect to gameograf.com with UTM tracking — traffic monetization confirmed.
• No CSP present on MV3 extension with innerHTML DOM sinks in popup.js and calendar.js — DOM-XSS risk.
• Developer name (Dekuy.com) does not match email domain (gameograf.com) — identity inconsistency.

Evidence

• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=dekuy&utm_medium=dekuy — UTM-tracked redirect.
• uninstall_url_hijack crx setUninstallURL points to https://gameograf.com/?utm_source=dekuy&utm_medium=dekuy.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html — every new tab served by extension.
• search_permission manifest Permission 'search' declared alongside newtab override — search hijack surface.
• dom_xss_sink crx innerHTML assignments from variables in popup.js and calendar.js with no CSP guard.
• no_csp manifest content_security_policy is null; MV3 default applies but DOM sinks remain unmitigated.
• developer_identity_mismatch store Developer name Dekuy.com, email domain gameograf.com, privacy policy on api.gameograf.com — three identities.
• low_install_monetization store Only 16 installs with full monetization apparatus (install/uninstall hijacks, UTM tracking).
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Gets cool Zenitsu Agatsuma [adware] + malext.io malicious_extension_sentry; score 5.35 -> 7.85 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding search provider — medium risk for search hijacking.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited surface.
• chrome_url_overrides.newtab high NewTab override captures every new tab — high-value real estate for monetization.

Pillar Scores

Bookkeeping