Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Cherry Lake [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall and install URL hijack both redirect to gameograf.com affiliate/UTM URL — monetization shell pattern.
• Privacy policy URL returns fetch error (ConnectionError) — effectively no accessible privacy policy.
• NewTab override combined with search permission and operator cluster of 50 dev-email siblings signals traffic-monetization operation.
• No CSP present (MV3 so no v2 bonus penalty, but dom_sink_innerhtml_userctrl findings elevate XSS risk).

Evidence

• install_url_hijack + uninstall_url_hijack manifest Both install and uninstall redirect to gameograf.com with UTM/affiliate params — monetization shell.
• privacy_policy_fetch_failed api privacy_policy_classification.fetched=false, reason=fetch_error:ConnectionError — policy inaccessible.
• operator_cluster_dev_email_siblings api dev_email dimension shows 50 sibling extensions under support@gameograf.com.
• newtab_override manifest chrome_url_overrides.newtab present; extension replaces every new tab page.
• dom_sink_innerhtml_userctrl crx Two DOM-XSS sinks in popup.js and calendar.js; no CSP to mitigate.
• operator_cluster_compound_sibling api compound fingerprint sibling_count=1 (lnagjecldcpfmlcgliojbhehighibhkj) — template-stamped extension pair.
• verified_publisher_with_monetization store verified_publisher=true but install/uninstall URL hijacks present — invariant 0c caps discount at -1.0.
• developer_name_absent store developer_name is empty string — accountability gap despite verified publisher badge.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Cherry Lake [adware] + malext.io malicious_extension_sentry; score 5.52 -> 8.02 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding search provider — monetization vector for NewTab extensions.
• host_permissions: https://api.gameograf.com/* low Scoped to dev's own API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces new tab page — high visibility surface, common monetization shell.

Pillar Scores

Operator Siblings (1)

Other extensions sharing this developer's compound fingerprint:

• lnagjecldcpfmlcgliojbhehighibhkj

Bookkeeping