Top Risks

• Fortnite brand impersonation by unconfirmed developer (gameograf.com ≠ Epic Games).
• NewTab override with search permission — classic ad-monetization shell; install+uninstall URL hijack confirms pattern.
• Privacy policy URL (haberikra.com) fetch failed — completely inaccessible; treated as no policy.
• No developer name listed; no 'Offered by' accountability signal.
• innerHTML DOM-XSS sink in popup.js with no CSP; MV3 mitigates but does not eliminate risk.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'fortnite'; developer domain gameograf.com is not Epic Games.
• newtab_override manifest chrome_url_overrides.newtab set to newtab.html; search permission also declared.
• install_uninstall_hijack crx Both onInstalled and uninstall URLs redirect to gameograf.com with UTM tracking parameters.
• privacy_policy_fetch_failed api privacy_policy_classification.fetched=false (HTTPError on haberikra.com/privacy-policy/); treated as no policy.
• no_developer_name store developer_name is empty string; no 'Offered by' identity visible.
• dom_xss_sink crx innerHTML assigned from variable in js/popup.js; no CSP present (csp_present=false).
• stale_extension store months_since_update=15; falls in 12-24mo band (+6.0 maintenance score).
• verified_publisher_cap store verified_publisher=true but months_since_update=15 (>12mo stale) caps discount at -1.0 per invariant 0c.

Permissions Breakdown

• search medium Allows manipulating search provider; combined with newtab override raises monetization concern.
• chrome_url_overrides.newtab high Replaces new-tab page entirely — primary vector for search/ad monetization.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.

Pillar Scores

Bookkeeping