Top Risks

• NewTab override replaces every new tab; install+uninstall URL hijack to developer domain for tracking.
• Privacy policy URL returns HTTP error — policy effectively unavailable; fetched==false scores max privacy risk.
• No CSP declared (MV3 default applies) combined with innerHTML DOM-XSS sink in popup.js.
• No developer name listed; verified_publisher alone insufficient given 15-month staleness.
• months_since_update=15 (6-12mo band) with newtab override raises long-term exposure risk.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html — replaces all new tabs for 1000 users.
• uninstall_url_hijack crx setUninstallURL to gameograf.com with UTM tracking params on uninstall.
• install_url_hijack crx onInstalled opens gameograf.com with UTM install tracking params.
• privacy_policy_fetch_failed api privacy_policy_classification.fetched=false due to HTTPError — policy inaccessible, scored +10.
• dom_xss_sink crx innerHTML assigned from variable in js/popup.js with no CSP; DOM-XSS risk.
• no_developer_name store developer_name is empty string; verified_publisher=true partially mitigates.
• staleness store months_since_update=15; falls in 12-24mo band (+6.0 maintenance).
• no_csp manifest content_security_policy=null; MV3 applies strict default but no explicit CSP declared.

Permissions Breakdown

• search medium Allows reading/modifying search engine settings; paired with newtab override raises risk.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces every new tab — high reach, monetization surface, search interception risk.

Pillar Scores

Bookkeeping