Top Risks

• Privacy policy URL unreachable (fetch error) — effectively no policy; score +10.0.
• Operator cluster of 9+ siblings under same fingerprint signals wallpaper-shell farm.
• Both install and uninstall URL hijacks confirmed — traffic monetization pattern.
• NewTab override with search permission; monetization surface even with only 1 search engine.
• DOM-XSS sinks (innerHTML) in popup.js and calendar.js with no CSP protection.

Evidence

• privacy_policy_unreachable api fetch_error:ConnectionError on https://api.gameograf.com/gameograf-privacy-policy.html — treated as no policy.
• operator_cluster_siblings api 9 compound-fingerprint siblings under same dev email/install-url/uninstall-url pattern (37 by email).
• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?utm_source=gameograf&utm_medium=link&utm_campaign=bg&utm_content=uninstall
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install&utm_medium=link&utm_campaign=bg&utm_content=install
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; paired with search permission.
• dom_xss_sinks crx innerHTML from variable in js/popup.js and js/calendar.js; no CSP present on MV3 extension.
• no_developer_name store developer_name is empty string; no Offered-by identity displayed.
• verified_publisher store verified_publisher=true but no featured badge; reputation floor 2.0 applied.

Permissions Breakdown

• search medium Allows querying browser search provider; paired with newtab override this shapes search monetization.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; expected for wallpaper/config fetches.
• chrome_url_overrides: newtab medium Replaces new-tab page; prime monetization surface for search/ad injection.

Pillar Scores

Operator Siblings (15)

Other extensions sharing this developer's compound fingerprint:

• kbbpgbdclanolnidddbeolaaddllgebp
• kgdahhodabbdnkkphjpneoiadhdphhna
• dihbfoicmibapnfojehonedckdjhegbe
• gfgopigkkjcinmgoancipefafljdfghd
• cdmooeifaodbcailnibfpnmbighehpkj
• pjbnoadhjobchdjkfhpehlbigakbjfii
• iobnmhnecelingbpdadgpmalbdagjbnb
• jpmpdfcaaelghoomjgdebmoekdfkhabp
• ohpdpicjlgbpihginhijhkfdcgfbffgf
• dbomdodikcfpocimcpegpbnlmankljcb
• dmdfahkplmikmlboodadelolcmbjgmff
• ckodcbbdgmpjidpfcipfobfagemmfapi
• kbolkhdnpodncbepmdejjijgkdpedgcj
• gfbhidjkgiaopiekkefehamhcmigdcna
• ekmpmfdhakdjaaifkfgpbcagdhlbamki

Bookkeeping