Top Risks

• NewTab override + search permission: replaces every new tab and can influence search, primary monetization surface.
• Install and uninstall URL hijack to gameograf.com with UTM tracking — classic engagement-monetization pattern.
• No CSP on MV3 extension with innerHTML sinks in popup.js and calendar.js — DOM-XSS exposure.
• Developer name field empty despite verified publisher status — accountability gap.
• 2000 installs with newtab override and no content-script scoping — tail attack surface if extension is later compromised.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces every new tab page.
• install_uninstall_hijack manifest Both install and uninstall URLs redirect to gameograf.com with UTM params — monetization tracking confirmed.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 with innerHTML sinks present.
• dom_xss_sinks crx innerHTML assigned from variable in popup.js and calendar.js without CSP — DOM-XSS risk.
• verified_publisher store Verified publisher badge present (gameograf.com resolves, email matches domain) — partial trust discount applied.
• privacy_policy_adequate api Policy fetched, scoped to extension, discloses data collection, retention, and third-party sharing.
• no_bad_hosts_no_cves api No bad host hits, no CVEs, no monetization/affiliate hits, no review red flags.
• developer_name_missing store developer_name field is empty string despite verified publisher — reduces accountability signal.

Permissions Breakdown

• search medium Grants ability to query/manipulate search; medium risk in context of newtab override.
• chrome_url_overrides.newtab high Replaces every new tab — high reach, monetization vector, pairs with search override.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.

Pillar Scores

Bookkeeping