Top Risks

• NewTab override with uninstall/install URL hijack redirecting to gameograf.com — monetization shell pattern.
• Uninstall and install URL hijack both fire to gameograf.com with UTM tracking params.
• No CSP present (MV3) paired with innerHTML DOM-XSS sinks in popup.js and calendar.js.
• Developer name field empty; 'Offered by' not disclosed — weak accountability.
• newtab override + search permission combination targets search monetization.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL points to https://gameograf.com/?utm_source=extension&utm_medium=install
• install_url_hijack manifest onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install — 3rd-party redirect.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; replaces every new tab with extension page.
• no_csp manifest content_security_policy is null; csp_present=false despite MV3 (no v2 penalty but innerHTML sinks unmitigated).
• dom_xss_sinks crx Two dom_sink_innerhtml_userctrl findings in popup.js and calendar.js; no CSP to constrain exploitation.
• verified_publisher store Extension carries verified publisher badge; months_since_update=4, domain resolves — full -3.0 discount applies.
• privacy_policy_adequate api Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true — fully scored.
• install_count_low store Only 23 installs; low blast radius but tail-attack-surface not flagged by anomaly checker.

Permissions Breakdown

• search medium Allows overriding search provider; medium risk for a NewTab extension.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; low blast radius.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary mechanism for this extension category.

Pillar Scores

Bookkeeping