Top Risks

• NewTab override replaces every new tab — high-reach surface for all users.
• Privacy policy is Google's generic policy, not scoped to this extension; admits data collection and 3rd-party sharing.
• Uninstall and install URL hijacks redirect to gameograf.com UTM-tracked pages — monetization shell pattern.
• No developer name listed; reduced accountability for a NewTab extension.
• innerHTML sinks in popup.js and calendar.js without CSP protection elevate DOM-XSS risk.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html — replaces every new tab for 678 users.
• uninstall_url_hijack crx setUninstallURL to https://gameograf.com with UTM tracking params.
• install_url_hijack crx onInstalled opens https://gameograf.com with UTM install tracking.
• generic_privacy_policy store Privacy URL is Google's own policy — scope_extension=false, data_collection=true, third_party_sharing=true.
• no_developer_name store developer_name is empty string; reduced accountability.
• no_csp manifest content_security_policy is null; MV3 default CSP applies but no explicit hardening.
• dom_xss_sinks crx innerHTML assigned from variables in popup.js and calendar.js without sanitization.
• verified_publisher store verified_publisher=true; provides partial accountability but does not offset monetization patterns.

Permissions Breakdown

• search medium Allows overriding or querying search; medium risk for a NewTab extension.
• host_permission: https://api.gameograf.com/* low Scoped to developer-owned API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces new-tab page; high-reach surface on every new tab opened.

Pillar Scores

Bookkeeping