Top Risks

• NewTab override + search permission: classic search-hijack/monetization shell pattern.
• Uninstall and install URL hijacks redirect to developer's own UTM-tracked pages.
• No CSP declared (MV3 default applies, but no explicit policy hardening); innerHTML DOM-XSS sink present.
• Developer name field empty; no 'Offered by' accountability despite verified publisher badge.
• Low install count (378) for a newtab override extension warrants scrutiny for tail-attack-surface growth.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html; replaces every new-tab page for the user.
• uninstall_url_hijack crx setUninstallURL targets gameograf.com with UTM params — webstore +3.0 penalty applied.
• install_url_hijack crx onInstalled opens gameograf.com UTM page — monetization/tracking on install.
• verified_publisher store Verified publisher badge present; discount applied but no featured badge.
• privacy_policy_adequate api Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true.
• dom_sink_innerhtml crx js/popup.js assigns innerHTML from variable — DOM-XSS risk; no CSP to mitigate.
• search_permission_newtab_combo manifest search permission + newtab override is the canonical search-monetization pattern.
• developer_name_missing store developer_name is empty string; reduces accountability despite verified publisher status.

Permissions Breakdown

• search medium Allows querying/overriding search; combined with newtab override amplifies search-hijack risk.
• host_permissions: https://api.gameograf.com/* low Scoped to dev-controlled domain only; limited blast radius.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary surface for monetization/tracking in this category.

Pillar Scores

Bookkeeping