Top Risks

• NewTab override combined with 'search' permission enables search-provider hijack and ad-monetization.
• Privacy policy is Google's generic account policy — not scoped to this extension; data collection and 3rd-party sharing admitted.
• Uninstall URL hijack redirects to gameograf.com tracking URL; install URL also hijacked — monetization pattern.
• bit.ly in js_external_hosts: affiliate/cloaking short-link redirector flagged by threat intel.
• No developer name listed; stale 16 months; no CSP — elevated governance and maintenance risk.

Evidence

• newtab_override manifest chrome_url_overrides.newtab=newtab.html; replaces every new tab with extension page.
• uninstall_url_hijack crx setUninstallURL → gameograf.com with UTM tracking params; monetization shell indicator.
• install_url_hijack crx onInstalled opens gameograf.com UTM URL; traffic-monetization pattern.
• generic_privacy_policy api Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• affiliate_hit api threat_intel.affiliate_hits: bit.ly flagged as affiliate/cloaking redirector in js_external_hosts.
• no_developer_name store developer_name is empty string; reduces accountability.
• verified_publisher_stale store verified_publisher=true but months_since_update=16 >12; 0c cap applies, discount capped at -1.0.
• no_csp manifest content_security_policy=null; MV3 strict default applies, no additional network penalty triggered.

Permissions Breakdown

• search medium Allows modification of search provider; combined with newtab override this is a search-hijack surface.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary mechanism for ad-monetization / search redirection.

Pillar Scores

Bookkeeping