Top Risks

• NewTab override with uninstall+install URL hijack to gameograf.com — traffic monetization pattern.
• No CSP declared (MV3 default only); DOM-XSS sinks in popup.js and calendar.js without CSP hardening.
• Missing developer name raises accountability gap despite verified publisher badge.
• search permission combined with newtab override enables search monetization.
• Install/uninstall URL hijack both redirect to utm-tagged gameograf.com endpoint.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html; replaces every new tab for all users.
• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?utm_source=extension&utm_medium=install
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install
• csp_absent manifest content_security_policy is null; no explicit CSP hardening on MV3 extension.
• dom_xss_sinks crx 2 innerHTML-from-variable sinks in popup.js and calendar.js with no CSP guard.
• verified_publisher store Publisher verified; gameograf.com resolves; not throwaway. Discounts reputation.
• privacy_policy_adequate api Policy scoped, data_collection=true, retention=true, third_party_sharing=true; adequate.
• no_developer_name store developer_name is empty string; reduces accountability despite verified publisher.

Permissions Breakdown

• search medium Allows reading/modifying search provider; medium risk when paired with newtab override.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; reasonable for a wallpaper/newtab extension.
• chrome_url_overrides.newtab medium Replaces new tab page; high reach, monetization vector, scored per rubric rule (a).

Pillar Scores

Bookkeeping