Top Risks

• Privacy policy URL returns fetch error — treated as no policy; data handling completely unknown.
• Uninstall and install URL hijacking to gameograf.com tracking endpoints; classic monetization shell pattern.
• NewTab override + search permission = monetization surface; part of 19-extension operator cluster.
• External JS host mlionltd.github.io is unrelated third-party GitHub Pages; supply-chain risk.
• No CSP on MV3 extension with innerHTML sink in popup.js; DOM-XSS exposure.

Evidence

• privacy_policy_fetch_failed api Privacy policy URL https://gameograf.com/privacy-policy/ returned HTTPError; classified as fetched=false → +10.0 privacy pillar.
• uninstall_url_hijack crx setUninstallURL to gameograf.com with UTM params; webstore +3.0 per rubric.
• install_url_hijack crx onInstalled opens gameograf.com with UTM params; webstore +2.0 per rubric.
• operator_cluster api 19 siblings share dev_email fingerprint; compound cluster sibling_count=3 → webstore +2.5.
• newtab_override manifest chrome_url_overrides.newtab replaces new tab with index.html; NewTab monetization pattern.
• external_js_host_mlionltd crx mlionltd.github.io listed in js_external_hosts; unrelated GitHub Pages domain is unverified supply-chain risk.
• no_csp manifest content_security_policy is null; no CSP on MV3 extension with innerHTML sink.
• verified_publisher_stale store Verified publisher but months_since_update=16 (>12mo); v0c cap applies, discount capped at -1.0.

Permissions Breakdown

• search medium Allows querying and potentially overriding search provider; combined with newtab override raises monetization concern.
• host_permission: https://api.gameograf.com/* low Scoped to developer's own API domain; limits blast radius but enables telemetry.
• chrome_url_overrides.newtab medium Replaces new tab page; classic monetization/data-collection surface for wallpaper shells.

Pillar Scores

Operator Siblings (6)

Other extensions sharing this developer's compound fingerprint:

• pikefoaagadfjcgbhgdhdboefoohdpbe
• onjaegfaigiefjodacjpeigblaifalab
• iofncbfmmdjkbalfhneppkeglboddgfl
• bdgjlkghndpkfhfhpdgeabcfnkjanagl
• gillmlaalielgmhgekhkolcbcjghaeki
• ediemaoaclggogobngcpcfdanoakkpga

Bookkeeping