Top Risks

• Privacy policy is Google's generic policy — does not scope to this extension at all (v3.5 D: +10.0 privacy).
• NewTab override + search permission = classic monetization/search-hijack shell pattern.
• Uninstall and install URL hijacks both present — traffic monetization confirmed.
• No CSP on MV3 extension with innerHTML DOM-XSS sinks in popup.js and calendar.js.
• No developer name listed; verified publisher discount partially offset by missing name.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html; replaces new-tab page for all users.
• uninstall_url_hijack crx setUninstallURL to gameograf.com UTM-tagged page — explicit traffic monetization.
• install_url_hijack crx onInstalled opens gameograf.com UTM-tagged page — monetization shell pattern.
• generic_privacy_policy api PP is myaccount.google.com/privacypolicy — scope_extension=false, data_collection=true, third_party_sharing=true.
• dom_xss_sink crx innerHTML sinks in popup.js and calendar.js with no CSP present — DOM-XSS risk.
• no_csp manifest content_security_policy is null; MV3 default helps but DOM sinks unmitigated.
• verified_publisher store verified_publisher=true but no developer_name set; partial trust reduction.
• search_permission_newtab manifest search + newtab combo with single Google search engine seen; low redirect risk but monetization shape.

Permissions Breakdown

• search medium Can manipulate default search provider, common in NewTab monetization shells.
• chrome_url_overrides.newtab medium Replaces new-tab page; high reach, typical monetization vector.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited surface.

Pillar Scores

Bookkeeping