Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — The drive on the road at sunset [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override with install+uninstall URL hijacks to gameograf.com — classic traffic-monetization shell pattern.
• Uninstall URL hijack redirects to third-party site with UTM tracking params on every removal.
• Install URL hijack opens third-party page on install — onInstalled redirect to 3rd party.
• No CSP present; two DOM-XSS innerHTML sinks in popup.js and calendar.js increase exploitation surface.

Evidence

• uninstall_url_hijack manifest setUninstallURL to https://gameograf.com/?utm_source=dekuy&utm_medium=dekuy — traffic monetization on removal.
• install_url_hijack manifest onInstalled opens https://gameograf.com/?utm_source=dekuy&utm_medium=dekuy — 3rd-party redirect on install.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html replaces every new-tab page.
• search_permission_plus_newtab manifest search permission + newtab override = search monetization capability cluster.
• no_csp crx content_security_policy is null; MV3 default applies but no explicit hardening.
• dom_xss_sinks crx innerHTML assigned from variables in popup.js and calendar.js — DOM-XSS risk without CSP.
• dev_identity_mismatch store developer_name=dekuy.com but email=support@gameograf.com and API on api.gameograf.com — split identity.
• no_ratings_no_installs store 0 rating, blank installs — low-accountability extension with no social proof.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — The drive on the road at sunset [adware] + malext.io malicious_extension_sentry; score 4.49 -> 6.99 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying the browser search engine; combined with newtab override amplifies search hijack risk.
• host_permissions: https://api.gameograf.com/* medium Scoped to developer API endpoint; but used for data exchange on every newtab load.
• chrome_url_overrides.newtab medium Replaces new-tab page — high-visibility, high-frequency user touchpoint enabling monetization.

Pillar Scores

Bookkeeping