Top Risks

• Privacy policy URL returns fetch error — treated as no policy; full +10 privacy score.
• Uninstall and install URL hijack both present; classic monetization/tracking shell pattern.
• NewTab override replaces every new tab page; broad reach for a 3K-install theme extension.
• dom_sink_innerhtml_userctrl in popup.js with no CSP — DOM-XSS risk elevated.
• No developer name listed; privacy policy hosted on unrelated domain (haberikra.com).

Evidence

• uninstall_url_hijack + install_url_hijack manifest Both install and uninstall redirect to gameograf.com with UTM tracking — monetization shell pattern.
• privacy_policy fetch failed api fetch_error:HTTPError on https://haberikra.com/privacy-policy/ — policy inaccessible, scored as absent.
• chrome_url_overrides.newtab manifest Extension overrides every new tab with newtab.html — high-reach monetization surface.
• dom_sink_innerhtml_userctrl crx innerHTML assigned from variable in popup.js; no CSP present to mitigate DOM-XSS.
• no developer_name store developer_name is empty string; reduces accountability.
• privacy policy on unrelated domain store Privacy policy URL domain haberikra.com differs from developer domain gameograf.com.
• months_since_update=15 store Last updated June 2025 but 15 months stale per field; scores in 12-24mo band (+6.0 maintenance).
• verified_publisher=true store Verified publisher; discount capped at -1.0 per v3.5 invariant 0c (monetization hits check clear, but stale >12mo).

Permissions Breakdown

• search medium Allows overriding default search; monetization risk when paired with newtab override.
• host_permissions: https://api.gameograf.com/* low Scoped to dev's own API domain; limited reach.
• chrome_url_overrides.newtab medium Replaces every new tab; high reach monetization surface.

Pillar Scores

Bookkeeping