Top Risks

• Uninstall URL hijack detected — extension redirects user on uninstall to a third-party URL.
• Install URL hijack detected — extension opens a third-party URL on install.
• Privacy policy is Google's generic account policy, not scoped to this extension; data_collection and third_party_sharing admitted.
• No permissions declared yet installs/uninstall URL hooks exist — unusual fingerprint for a game extension.
• MV3 with no CSP declared; external JS host gameograf.com loaded.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() set; target null (could resolve at runtime). Monetization/tracking pattern.
• install_url_hijack crx onInstalled opens third-party URL; target null (resolved at runtime). Common ad-monetization shell pattern.
• privacy_policy_generic store Privacy URL is Google Account policy (scope_extension=false, data_collection=true, third_party_sharing=true). +10 privacy pillar.
• js_external_hosts crx Extension loads JS from gameograf.com — developer-controlled but external code execution surface.
• no_csp crx content_security_policy is null. MV3 strict default applies but no explicit CSP declared.
• low_install_count store Only 17 installs; rating count not meaningful. Limited blast radius but unverified developer.
• not_verified_publisher store No verified publisher badge; no featured badge. Developer reputation unestablished.
• install_uninstall_hijack_combo crx Both install and uninstall URL hijacks present with no permissions declared — shell-pattern fingerprint.

Pillar Scores

Bookkeeping