Top Risks

• NewTab override with uninstall+install URL hijack to gameograf.com — classic monetization shell pattern.
• Two innerHTML DOM-XSS sinks (popup.js, calendar.js) with no CSP; escalated risk under FIX B.
• No developer name listed; developer identity partially obscured despite verified publisher badge.
• search permission + newtab override = search monetization surface; only one search engine seen but probe not run.
• Privacy policy scoped and complete, but third-party sharing admitted — all data flows should be audited.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → https://gameograf.com/?utm_source=extension&utm_medium=install (3rd-party redirect).
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install on every install.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; search permission also declared — monetization pair.
• dom_xss_sinks crx innerHTML sinks in popup.js and calendar.js; csp_present==false triggers FIX B escalation (+2.0 each → capped).
• verified_publisher store Verified publisher badge present; discount applied but capped at -1.0 due to monetization redirect signals (v3.5 E).
• no_developer_name store developer_name is empty string; reduces accountability despite verified email domain.
• privacy_policy_adequate api Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true — fully disclosed.
• webstore_monetization_pattern store Install+uninstall URL hijack (+4.0 total) plus NewTab+search combo; low installs (862) limits blast radius.

Permissions Breakdown

• search medium Allows reading/modifying search engine settings; combined with NewTab override raises monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; legitimate data fetch but still an outbound channel.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary vector for search monetization and user-tracking in this extension category.

Pillar Scores

Bookkeeping