Top Risks

• NewTab override with install/uninstall URL hijack — classic monetization shell pattern.
• Contacts mlionltd.github.io (unaffiliated third-party JS host) alongside own API.
• No developer name listed despite verified publisher badge.
• 16 months since last update — approaching stale threshold for a NewTab extension.
• innerHTML sink in popup.js without CSP guard — minor DOM-XSS surface.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to index.html — replaces new-tab page.
• uninstall_url_hijack crx setUninstallURL targets gameograf.com with UTM params — traffic monetization signal.
• install_url_hijack crx onInstalled opens gameograf.com with UTM params — install redirect.
• external_js_host_unaffiliated crx mlionltd.github.io in js_external_hosts — unaffiliated GitHub Pages domain.
• verified_publisher store Verified publisher badge present; domain resolves; not stale-capped.
• privacy_policy_complete api Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true.
• dom_sink_innerhtml crx popup.js assigns innerHTML from variable without CSP; low severity given MV3 and no eval.
• stale_16mo store 16 months since last update — Maintenance pillar at 6.0 (6-12mo band ceiling, borderline 12-24mo).

Permissions Breakdown

• search medium Allows querying search provider; paired with newtab override raises monetization concern.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain only.
• chrome_url_overrides.newtab medium Replaces new-tab page — primary surface for wallpaper but also monetization vector.

Pillar Scores

Bookkeeping