Top Risks

• New-tab override replaces every new tab — high daily reach for a wallpaper extension.
• Privacy policy is Google's own generic policy, not scoped to this extension; data_collection+3rd_party_sharing admitted with no extension scope.
• Uninstall and install URL hijacks redirect to gameograf.com UTM links — monetization pattern.
• Two innerHTML-from-variable sinks (popup.js, calendar.js) with no CSP — DOM-XSS surface.
• No developer name listed; verified publisher discount partially offset by generic Google privacy policy.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html — replaces every new tab.
• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?utm_source=gameograf&utm_campaign=bg&utm_content=uninstall
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install&utm_campaign=bg&utm_content=install
• generic_privacy_policy store Privacy URL is Google's own policy (myaccount.google.com/privacypolicy); scope_extension=false, data_collection+3rd_party_sharing=true.
• dom_xss_sink crx innerHTML from variable in js/popup.js and js/calendar.js; no CSP to mitigate.
• no_csp manifest content_security_policy is null — no CSP protection for MV3 extension.
• no_developer_name store developer_name is empty string; only email support@gameograf.com available.
• verified_publisher store Extension carries verified publisher badge; partially mitigates reputation risk.

Permissions Breakdown

• search medium Allows overriding search provider — medium impact on its own.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; narrow host access.
• chrome_url_overrides.newtab medium Replaces new-tab page; monetization vector, broad daily reach.

Pillar Scores

Bookkeeping