Top Risks

• Privacy policy URL fetch failed — treated as no policy; data handling completely opaque.
• Operator cluster of 40 sibling extensions under same developer email — mass NewTab monetization factory.
• Both install and uninstall URL hijack active — tracks user lifecycle for ad/affiliate purposes.
• NewTab override with search permission is a monetization shell pattern; search_engine_count=1 (Google).
• Two innerHTML DOM-XSS sinks with no CSP — elevated injection risk if API responses are attacker-influenced.

Evidence

• privacy_policy_fetch_failed api privacy_policy_classification.fetched==false (HTTPError); scored as no policy → +10.0 Privacy.
• operator_cluster api sibling_count=12 compound; dev_email cluster=40 extensions. +2.5 Webstore.
• uninstall_url_hijack manifest setUninstallURL→gameograf.com with UTM tracking. +3.0 Webstore.
• install_url_hijack manifest onInstalled opens gameograf.com with UTM tracking. +2.0 Webstore.
• newtab_override_with_search manifest chrome_url_overrides.newtab + search permission. NewTab monetization shell pattern. +2.0 Webstore.
• dom_xss_sinks_no_csp crx 2x innerHTML from variable in popup.js and calendar.js; csp_present=false. +2.0 Code Quality.
• no_developer_name store developer_name is empty string. +1.0 Reputation.
• verified_publisher store verified_publisher=true; -3.0 Reputation but floored at 2.0 per hard-floor rule.

Permissions Breakdown

• search medium Allows reading/overriding search provider; paired with newtab override increases monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to developer-controlled domain only.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary monetization surface for this extension class.

Pillar Scores

Operator Siblings (15)

Other extensions sharing this developer's compound fingerprint:

• kbbpgbdclanolnidddbeolaaddllgebp
• kgdahhodabbdnkkphjpneoiadhdphhna
• dihbfoicmibapnfojehonedckdjhegbe
• gfgopigkkjcinmgoancipefafljdfghd
• cdmooeifaodbcailnibfpnmbighehpkj
• pjbnoadhjobchdjkfhpehlbigakbjfii
• iobnmhnecelingbpdadgpmalbdagjbnb
• jpmpdfcaaelghoomjgdebmoekdfkhabp
• ohpdpicjlgbpihginhijhkfdcgfbffgf
• cifonlmfhnimmghojdepepjdgbbminel
• dbomdodikcfpocimcpegpbnlmankljcb
• dmdfahkplmikmlboodadelolcmbjgmff
• kbolkhdnpodncbepmdejjijgkdpedgcj
• gfbhidjkgiaopiekkefehamhcmigdcna
• ekmpmfdhakdjaaifkfgpbcagdhlbamki

Bookkeeping