Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — akatsuki assemble [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy URL returns connection error — effectively no policy; score 10.0.
• Both install and uninstall URL hijacks redirect to gameograf.com with UTM tracking.
• NewTab override on a low-install (43) extension with mismatched dev name (Dekuy.com) vs email domain (gameograf.com).
• Two innerHTML DOM-XSS sinks with no CSP present (MV3 but csp_present=false).

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → https://gameograf.com/?utm_source=dekuy&utm_medium=dekuy (3rd party monetization).
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=dekuy&utm_medium=dekuy.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html — replaces every new tab page.
• privacy_policy_fetch_error api privacy_policy_classification.fetched=false; ConnectionError — policy effectively unavailable.
• dom_xss_sink crx Two innerHTML sinks (popup.js, calendar.js) with no CSP — DOM-XSS risk on every new tab open.
• dev_name_domain_mismatch store Developer listed as Dekuy.com but email/API/uninstall URL all point to gameograf.com.
• low_install_newtab store 43 installs, no ratings, unverified publisher — NewTab shell with monetization hooks.
• no_csp manifest content_security_policy is null on MV3 extension with innerHTML sinks and remote API calls.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — akatsuki assemble [adware] + malext.io malicious_extension_sentry; score 5.33 -> 7.83 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding search provider — medium risk on its own, high in context of NewTab override.
• host_permissions: https://api.gameograf.com/* medium Scoped to dev domain; enables API calls to gameograf backend for data exfil.
• chrome_url_overrides.newtab medium Replaces every new tab — high-reach surface for ad/redirect monetization.

Pillar Scores

Bookkeeping