Top Risks

• Privacy policy is Google's generic policy — does not scope to this extension; admits data collection and 3rd-party sharing (+10 privacy pillar).
• NewTab override replaces every new-tab page; install/uninstall URL hijacks track lifecycle events via UTM to gameograf.com.
• Uninstall URL hijack (+3.0) and install URL hijack (+2.0) are monetization/tracking shell signals.
• No developer name listed; verified publisher but no featured badge; newtab override with monetization shape.
• innerHTML DOM-XSS sink in popup.js with no CSP present raises code quality risk.

Evidence

• uninstall_url_hijack manifest setUninstallURL points to gameograf.com with UTM tracking params — monetization shell signal.
• install_url_hijack manifest onInstalled opens gameograf.com with UTM install tracking — monetization shell signal.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html — replaces every new tab for all users.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• dom_xss_sink crx js/popup.js: innerHTML assigned from variable with no CSP — DOM-XSS risk.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• developer_name_missing store developer_name is empty string; verified_publisher true but no displayed name.
• months_since_update store 16 months since last update (May 2025); falls in 12-24 month stale band.

Permissions Breakdown

• search medium Allows reading/manipulating search queries; elevated in context of NewTab override.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces every new-tab page; persistent reach over all users' browsing sessions.

Pillar Scores

Operator Siblings (13)

Other extensions sharing this developer's compound fingerprint:

• kenndofkbpgkfhaecjmnjmehhhbnioeh
• ieepfmpmjnjidennkopcbamjjdemhjcf
• bpicplogeibhabicoedobpchdkngbhjh
• jmokcnonladmkkdlgbalffkjiogfcgha
• aaobffjniaghknbgjdkigmcnapghemfa
• cfbobdhebljlbkhdhnikebhhijocphfo
• ckcailiifgopnblmaeaefimdgnaelcph
• dpkgeginpcjfcgnjicpkfkkbnpailidn
• hmagnnippelpfgkmbdnepolcgjlmbohh
• jimikjehahhdekhbmhpbmbponjcimajc
• jofgjibhmlaeofgmidllemkckkpgnpbd
• iimgbphfdpnahafdmikdjnpfnffnbkcl
• gafbkkfalgndkoilabfhmjjjgeihboed

Bookkeeping