Top Risks

• NewTab override with uninstall/install URL hijack to developer tracking endpoints.
• No CSP declared (MV3 strict default applies, but dom_sink_innerhtml_userctrl finding present in calendar.js).
• Wallpaper/theme shell contacts multiple Google service domains and own API beyond stated wallpaper function.
• No developer name listed; verified publisher but empty 'Offered by' field reduces accountability signal.
• New-tab override with 'search' permission creates latent search-monetization surface.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL points to gameograf.com with UTM tracking params.
• install_url_hijack crx onInstalled opens gameograf.com with UTM install tracking — engagement harvesting.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; replaces every new-tab page for all users.
• no_csp manifest content_security_policy is null; dom_sink_innerhtml_userctrl finding in calendar.js elevates XSS risk.
• dom_sink_innerhtml crx js/calendar.js assigns user-controlled variable to innerHTML — DOM-XSS sink per code scan.
• js_external_hosts_broad crx 12 external hosts including Google services and chat.openai.com beyond wallpaper function.
• verified_publisher store gameograf.com verified publisher; domain resolves, not throwaway — partial trust signal.
• privacy_policy_scoped api Policy at gameograf.com/privacy-policy/ is scoped, documents collection, retention, third-party sharing.

Permissions Breakdown

• search medium Allows reading/modifying search settings; common in NewTab overrides but elevates risk.
• alarms low Schedules callbacks; minimal standalone risk.
• storage low Local data persistence; standard, low risk.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary monetization/engagement vector for this category.
• host_permissions: https://api.gameograf.com/* low Scoped to own API domain only; limited reach.

Pillar Scores

Bookkeeping