Top Risks

• NewTab override with uninstall/install URL hijack — classic monetization shell pattern.
• DOM-XSS sinks (innerHTML from variable) in popup.js and calendar.js with no CSP.
• No CSP on MV3 extension with active JS external hosts increases XSS exploitability.
• Verified publisher but no developer name listed; uninstall/install redirect to own domain.
• Fan-content theme shell with 225 installs yet broad external JS host list.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces new tab page.
• uninstall_url_hijack crx setUninstallURL to gameograf.com UTM link; install redirect also present.
• no_csp manifest content_security_policy is null; csp_present == false on MV3 extension.
• dom_xss_sink crx innerHTML assigned from variable in popup.js and calendar.js — DOM-XSS risk without CSP.
• verified_publisher store support@gameograf.com verified; domain resolves, not throwaway.
• privacy_policy_adequate api Policy fetched, scoped, data_collection+retention+third_party_sharing all disclosed.
• fan_content_shell store Anime fan-content NewTab with 225 installs; install/uninstall URL hooks present.
• maintenance_stale store 12 months since update — 6-12mo bracket adds 3.5 to maintenance pillar.

Permissions Breakdown

• search medium Allows reading/modifying search queries; medium risk in NewTab context.
• host_permissions: https://api.gameograf.com/* low Scoped to dev-controlled API domain only; no broad host access.
• chrome_url_overrides.newtab medium Replaces new tab page — core browser surface override with monetization potential.

Pillar Scores

Bookkeeping