Top Risks

• NewTab override with search permission — classic ad-monetization shell pattern.
• Both install and uninstall URL hijacks to developer tracking URLs.
• Two innerHTML DOM-XSS sinks with no CSP to mitigate exploitation.
• No developer name listed; verified publisher but identity weakly anchored.
• jquery 3.7.1 bundled without CSP — XSS sink risk amplified.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces new-tab page for all users.
• uninstall_url_hijack crx setUninstallURL targets https://gameograf.com/?utm_source=gameograf&utm_medium=link&utm_campaign=bg&utm_content=uninstall
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install&utm_medium=link&utm_campaign=bg&utm_content=install
• dom_xss_sinks crx Two innerHTML assignments from variables in popup.js and calendar.js; no CSP present (MV3 default).
• no_csp manifest content_security_policy is null; csp_present == false. DOM sinks unmitigated.
• verified_publisher store verified_publisher=true; domain resolves; not throwaway. Caps discount at standard level.
• privacy_policy_adequate api Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true.
• no_developer_name store developer_name is empty string; identity anchored only to email and verified publisher badge.

Permissions Breakdown

• search medium Allows search-provider manipulation; combined with newtab override raises monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides: newtab medium Replaces new-tab page — primary monetization vector for this category.

Pillar Scores

Bookkeeping