Top Risks

• NewTab override with uninstall/install URL hijack to gameograf.com — monetization shell pattern.
• Privacy policy fetch failed; policy classified as no-scope, no-data-collection disclosure → Privacy pillar 10.0.
• No CSP on MV3 extension with innerHTML sinks in popup.js and calendar.js — DOM-XSS exposure.
• No developer name listed; missing 'Offered by' identity increases accountability gap.
• Uninstall URL redirect to UTM-tracked page confirms traffic-monetization intent.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html — replaces every new tab.
• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?utm_source=gameograf&utm_medium=link&utm_campaign=bg&utm_content=uninstall
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install&utm_medium=link&utm_campaign=bg&utm_content=install
• privacy_policy_fetch_failed api fetch_error:HTTPError on https://gameograf.com/privacy-policy/ — policy unverifiable; scored +10.0.
• no_csp manifest content_security_policy is null on MV3; innerHTML sinks in popup.js and calendar.js unmitigated.
• dom_xss_sinks crx dom_sink_innerhtml_userctrl in popup.js and calendar.js with no CSP → FIX B applies (+2.0).
• no_developer_name store developer_name is empty string; no 'Offered by' identity visible in store listing.
• verified_publisher store verified_publisher=true; discount applied but capped — policy unfetchable satisfies 0c cap condition.

Permissions Breakdown

• search medium Allows reading/manipulating search provider; paired with newtab override raises monetization risk.
• chrome_url_overrides.newtab medium Replaces new-tab page — primary vector for ad/search monetization shells.
• host_permissions: https://api.gameograf.com/* low Scoped to developer-owned API domain; limited blast radius.

Pillar Scores

Bookkeeping