Top Risks

• Privacy policy is Google's own policy (not scoped to this extension) yet admits data collection and third-party sharing — +10.0 privacy pillar.
• Uninstall and install URL hijacks to gameograf.com tracking URLs — classic monetization shell pattern.
• New-tab override replaces every new tab; combined with search permission creates broad monetization surface.
• No content security policy (MV3 default applies but no explicit CSP); innerHTML sink in popup.js.
• Stale 16 months; months_since_update triggers verified-publisher cap at -1.0 per invariant 0c.

Evidence

• privacy_policy_generic store Privacy URL is Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• uninstall_url_hijack crx uninstall_url_hijack=true targeting gameograf.com with UTM params → +3.0 webstore.
• install_url_hijack crx install_url_hijack=true targeting gameograf.com with UTM params → +2.0 webstore.
• newtab_override manifest chrome_url_overrides.newtab replaces every new tab; monetization shape → +2.0 webstore.
• dom_sink_innerhtml crx innerHTML from variable in js/popup.js; csp_present=false → +2.0 code quality (FIX B).
• developer_name_missing store developer_name is empty string; no 'Offered by' visible → +1.0 reputation.
• verified_publisher_stale store verified_publisher=true but months_since_update=16 > 18 threshold caps discount at -1.0 per invariant 0c.
• external_host_mlionltd_github_io crx js_external_hosts includes mlionltd.github.io — third-party GitHub Pages host outside dev domain.

Permissions Breakdown

• search medium Allows querying and potentially overriding search; medium risk on its own.
• host_permission: https://api.gameograf.com/* low Scoped to developer's own API domain; bounded reach.
• chrome_url_overrides.newtab medium Replaces every new tab; high-reach surface for monetization or data capture.

Pillar Scores

Bookkeeping