Top Risks

• Privacy policy URL unreachable (fetch error) — effectively no policy; score +10.0 on privacy pillar.
• New-tab override replaces every new tab for 5,000 users with a developer-controlled page.
• Uninstall and install URL hijacks redirect users to gameograf.com with UTM tracking on both events.
• No developer name listed; dev_email-only identity with 36 sibling extensions under same email cluster.
• innerHTML DOM-XSS sink in calendar.js with no CSP — elevates code quality risk.

Evidence

• privacy_policy_unreachable api privacy_policy_classification.fetched=false; reason=fetch_error:HTTPError. Treated as no policy (+10.0 privacy).
• newtab_override manifest chrome_url_overrides.newtab=newtab.html — replaces every new tab, high reach.
• uninstall_url_hijack crx setUninstallURL to gameograf.com with UTM params (+3.0 webstore).
• install_url_hijack crx onInstalled opens gameograf.com with UTM params (+2.0 webstore).
• no_developer_name store developer_name is empty; no verified publisher; +1.0 reputation.
• operator_cluster_dev_email api 36 sibling extensions share same dev email support@gameograf.com — high-volume shell operator pattern.
• dom_xss_no_csp crx dom_sink_innerhtml_userctrl in calendar.js; csp_present=false → +2.0 code quality (FIX B).
• newtab_search_engine api search_engine_count=1 (google.com); no multi-engine monetization anomaly.

Permissions Breakdown

• search medium Can intercept or observe search queries; medium risk for a NewTab override.
• alarms low Scheduling only; no data access.
• storage low Local extension storage; low standalone risk.
• host_permissions: https://api.gameograf.com/* medium Scoped to own API domain; enables data transmission to developer server.
• chrome_url_overrides.newtab medium Replaces every new tab; high reach over user browsing sessions.

Pillar Scores

Bookkeeping