Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Brawl Stars Football Gameograf [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override + search override: classic ad-monetization shell, installs/uninstalls tracked via UTM hijack URLs.
• Uninstall and install URL hijacking to gameograf.com with UTM campaign tracking.
• No CSP on MV3 extension with innerHTML DOM-XSS sinks in popup.js and calendar.js.
• Developer name field empty; low install count (542) for a game-fan newtab extension raises tail-attack-surface concern.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces every new tab with extension page.
• uninstall_url_hijack crx setUninstallURL points to https://gameograf.com/?utm_source=gameograf&utm_medium=link&utm_campaign=bg&utm_content=uninstall
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install&utm_medium=link&utm_campaign=bg&utm_content=install
• no_csp manifest content_security_policy is null; MV3 default CSP applies but no explicit restriction on connect/script-src.
• dom_xss_sinks crx Two innerHTML-from-variable sinks found in popup.js and calendar.js with no CSP hardening.
• search_override manifest Declares 'search' permission alongside newtab override — enables search monetization.
• developer_name_missing store developer_name is empty string; verified_publisher is true but no display name shown.
• privacy_policy_adequate api Policy at gameograf.com/privacy-policy fetched; scope_extension, data_collection, retention, third_party_sharing all true.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Brawl Stars Football Gameograf [adware] + malext.io malicious_extension_sentry; score 4.29 -> 6.79 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding search provider; paired with newtab override is a monetization vector.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary surface for ad/search monetization shells.
• host_permissions: https://api.gameograf.com/* low Narrow host permission scoped to dev's own API domain.

Pillar Scores

Bookkeeping