Top Risks

• Google privacy policy linked — not scoped to this extension; admits 3rd-party sharing → privacy pillar maxed.
• Operator cluster of 41 sibling extensions under same email; 6 compound-fingerprint siblings — mass-install factory pattern.
• Uninstall and install URL hijacks redirect to gameograf.com with UTM tracking — confirmed monetization shell.
• NewTab override + search permission enables silent search-provider monetization on every new tab.
• DOM-XSS sink (innerHTML from variable) in popup.js with no CSP — elevated injection risk.

Evidence

• privacy_policy_generic store Policy URL is Google's own privacy page; scope_extension=false, data_collection=true, third_party_sharing=true → D rule +10.
• operator_cluster_siblings api support@gameograf.com linked to 41 extensions by email, 6 by compound fingerprint — factory pattern.
• install_uninstall_hijack crx Both onInstalled and uninstall open gameograf.com with UTM params — confirmed monetization redirects.
• newtab_override_search manifest chrome_url_overrides.newtab + search permission = full new-tab monetization surface.
• dom_sink_no_csp crx innerHTML sink in popup.js; csp_present=false → FIX B applies, +2.0 code quality.
• newtab_with_monetization store NewTab+monetization shape: +2.0 webstore. Fan-content/theme shell (Hamilton wallpapers): +1.5.
• maintenance_stale store 16 months since update → 6-12 month band = +3.5, plus stale >12mo = +6.0 bracket.
• mlionltd_github_external_host crx js_external_hosts includes mlionltd.github.io — third-party GitHub Pages host, unverified operator.

Permissions Breakdown

• search medium Allows querying/altering search provider behavior; typical for NewTab monetization.
• host_permission: https://api.gameograf.com/* medium Scoped to dev-controlled API; enables data exfil or remote config from operator.
• chrome_url_overrides.newtab medium Replaces every new tab with operator-controlled page; primary monetization surface.

Pillar Scores

Operator Siblings (6)

Other extensions sharing this developer's compound fingerprint:

• pikefoaagadfjcgbhgdhdboefoohdpbe
• onjaegfaigiefjodacjpeigblaifalab
• iofncbfmmdjkbalfhneppkeglboddgfl
• daaiminpbfdcmdacaomdnemceoillghm
• bdgjlkghndpkfhfhpdgeabcfnkjanagl
• gillmlaalielgmhgekhkolcbcjghaeki

Bookkeeping