Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and third-party sharing (Privacy pillar maxed).
• New-tab override combined with install/uninstall URL hijack to gameograf.com — classic monetization shell pattern.
• Uninstall URL hijack and install URL hijack both confirmed; revenue-driven lifecycle tracking.
• No developer name provided; reduced accountability for a new-tab replacement extension.
• innerHTML DOM-XSS sink in popup.js with no CSP present; XSS risk if attacker influences html variable.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to index.html; replaces every new-tab page.
• uninstall_url_hijack crx setUninstallURL targets https://gameograf.com/?utm_source=uninstall — 3rd-party lifecycle tracking.
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install — monetization redirect on install.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true.
• no_developer_name store developer_name is empty string; no 'Offered by' accountability signal.
• dom_xss_sink crx js/popup.js: innerHTML assigned from variable with no CSP — DOM-XSS risk.
• external_host_mlionltd_github_io crx js_external_hosts includes mlionltd.github.io — third-party GitHub Pages endpoint, unrelated to stated function.
• no_csp manifest content_security_policy is null; no CSP protection despite innerHTML sink in code.

Permissions Breakdown

• search medium Allows reading and manipulating search queries; medium risk on its own.
• host_permissions: https://api.gameograf.com/* low Scoped to own API domain only; low blast radius.
• chrome_url_overrides.newtab medium Replaces new-tab page; classic monetization/search-redirect vector.

Pillar Scores

Bookkeeping