Top Risks

• Privacy policy is Google's generic policy — not scoped to this extension, yet admits data collection and 3rd-party sharing (+10.0 privacy).
• NewTab override + search override is a monetization shell pattern with install/uninstall URL hijack to developer domain.
• Uninstall and install URL hijack to gameograf.com tracking URLs — engagement funnel exfiltration.
• No developer name listed; verified publisher discount partially offset by stale >18mo invariant 0c cap.
• DOM-XSS innerHTML sink in popup.js without CSP raises code quality risk.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = index.html — replaces every new tab page.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• install_uninstall_hijack crx Both install and uninstall URLs redirect to gameograf.com with UTM tracking parameters.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.
• dom_xss_sink crx innerHTML assigned from variable in js/popup.js with no CSP guard.
• stale_verified_publisher store verified_publisher=true but months_since_update=16 (>18mo cap NOT triggered, 16<18; discount applies partially).
• no_developer_name store developer_name is empty string — no display name on store listing.
• external_host_github crx js_external_hosts includes mlionltd.github.io — third-party GitHub Pages domain outside developer control.

Permissions Breakdown

• search medium Allows overriding search provider; medium risk in context of NewTab override pattern.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain only.
• chrome_url_overrides.newtab medium Replaces every new tab; high-reach monetization surface.

Pillar Scores

Bookkeeping