Top Risks

• Uninstall URL hijack sends user to gameograf.com on removal — tracking/monetization on exit.
• Install URL hijack opens gameograf.com on install — unsolicited redirect.
• New-tab override is core monetization surface; 'search' permission compounds control.
• No CSP declared (MV3 default enforced, but dom_sink_innerhtml in calendar.js still poses XSS risk if input is unsanitised).
• Developer name absent in listing; no verified publisher badge despite support email matching domain.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → https://gameograf.com/?p=33118?utm_source=extension&utm_medium=uninstall
• install_url_hijack crx onInstalled opens https://gameograf.com/?p=33118?utm_source=extension&utm_medium=install
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; replaces every new tab for all users.
• dom_sink_innerhtml_userctrl crx js/calendar.js assigns variable to innerHTML without visible sanitisation — DOM-XSS risk.
• no_developer_name store developer_name field is empty; identity accountability reduced.
• privacy_policy_adequate api Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true.
• verified_publisher store verified_publisher=true but is_featured_by_google=false; partial trust signal.
• low_installs store Only 234 installs; install/uninstall URL hijacks suggest traffic-monetization intent at low scale.

Permissions Breakdown

• search medium Allows reading/manipulating search provider; pairs with newtab override for monetization risk.
• alarms low Scheduling only; no direct data access.
• storage low Local preference storage; low standalone risk.
• chrome_url_overrides.newtab medium Replaces every new tab page; core monetization surface for this category.
• host_permissions: https://api.gameograf.com/* low Scoped to dev's own API domain; not broad host access.

Pillar Scores

Bookkeeping