Top Risks

• Google's generic privacy policy used — does not scope to this extension; admits data collection and 3rd-party sharing (Privacy pillar max).
• Uninstall URL hijack redirects to gameograf.com UTM page; install URL hijack opens Stranger Things promo page (+3.0+2.0 Webstore).
• NewTab override with search permission and no CSP — classic monetization shell pattern.
• No developer name disclosed; blank 'Offered by' field raises accountability concerns.
• No CSP on MV3 extension with innerHTML DOM-XSS sinks in popup.js and calendar.js.

Evidence

• uninstall_url_hijack manifest setUninstallURL → gameograf.com UTM link; +3.0 Webstore per rubric.
• install_url_hijack manifest onInstalled opens stranger-things-5-live-wallpaper promo URL; +2.0 Webstore.
• newtab_override manifest chrome_url_overrides.newtab present with search permission — monetization NewTab pattern; +2.0 Webstore.
• privacy_policy_generic store Policy is Google's own account policy: scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy (v3.5D).
• no_developer_name store developer_name is empty string; no 'Offered by' identity; +1.0 Reputation.
• dom_sink_innerhtml crx Two innerHTML-from-variable sinks in popup.js and calendar.js; no CSP present → +2.0 Code Quality.
• verified_publisher store verified_publisher=true; -3.0 Reputation base but capped at -1.0 due to monetization URL hijacks (v3.5E).
• no_csp manifest csp_present=false on MV3 extension; amplifies DOM-XSS risk from innerHTML sinks.

Permissions Breakdown

• search medium Allows reading/overriding search provider; relevant to NewTab monetization pattern.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces new-tab page; high-visibility monetization surface per rubric v2a.

Pillar Scores

Bookkeeping