Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Magical forest butterfly [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override + uninstall/install URL hijack to gameograf.com UTM tracking — classic monetization shell.
• No CSP (csp_present=false) + two innerHTML DOM-XSS sinks elevates code quality risk.
• Developer name (dekuy.com) mismatches email domain (gameograf.com) — accountability gap.
• Unverified publisher, 43 installs; extension is obscure with monetization infrastructure in place.

Evidence

• uninstall_url_hijack manifest setUninstallURL → https://gameograf.com/?utm_source=dekuy&utm_medium=dekuy (3rd-party UTM redirect)
• install_url_hijack manifest onInstalled opens https://gameograf.com/?utm_source=dekuy&utm_medium=dekuy
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; every new tab controlled by extension
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening
• dom_xss_sinks crx innerHTML assigned from variable in popup.js and calendar.js without CSP guard
• dev_domain_mismatch store developer_name=dekuy.com but email=support@gameograf.com; two distinct domains
• low_install_monetization store Only 43 installs but full UTM/affiliate install+uninstall redirect infrastructure in place
• privacy_policy_adequate api Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Magical forest butterfly [adware] + malext.io malicious_extension_sentry; score 4.09 -> 6.59 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/overriding search provider; paired with newtab override = search monetization surface.
• host_permissions: https://api.gameograf.com/* low Scoped to dev-controlled API domain only; low blast radius.
• chrome_url_overrides.newtab medium Replaces every new tab with extension page; classic monetization/tracking vector.

Pillar Scores

Bookkeeping