Top Risks

• NewTab override by a 15-sibling operator cluster with uninstall+install URL hijack — mass newtab monetization factory.
• Privacy policy URL returns ConnectionError (fetch_error); policy treated as absent — full +10.0 privacy score.
• Operator fingerprint shared by 50 dev-email siblings and 21 uninstall/CSP-host siblings — industrial shell pattern.
• Uninstall and install URL both hijacked to gameograf.com UTM affiliate endpoint.
• Two innerHTML DOM-XSS sinks with no CSP; MV3 but no content_security_policy declared.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces every new tab for 269 installs.
• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?utm_source=extension&utm_medium=install (3rd-party UTM).
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install.
• operator_cluster api 15 compound siblings; 50 sharing dev email; 21 sharing uninstall URL — mass newtab shell factory.
• privacy_policy_unreachable api fetch_error:ConnectionError on https://api.gameograf.com/gameograf-privacy-policy.html — treated as absent.
• dom_xss_sinks crx 2× innerHTML from user-controlled variable in popup.js and calendar.js; no CSP present.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit restriction declared.
• search_permission_newtab manifest 'search' permission combined with newtab override enables search monetization without declared redirect.

Permissions Breakdown

• search medium Allows reading/overriding search provider; medium risk in newtab context.
• chrome_url_overrides.newtab high Replaces every new-tab page; high reach, monetization surface, search redirect risk.
• host_permissions: https://api.gameograf.com/* medium Scoped to dev API; enables data exfil to controlled endpoint.

Pillar Scores

Operator Siblings (15)

Other extensions sharing this developer's compound fingerprint:

• fdjpcjggpgdmdikmhoagohakklihimbo
• ammndifopdgpjcpmpbdenfcafipnejlj
• ojhigfemmjpjnmhidflhdlcahgdiiija
• ieocbmlfbinpcffofcjmpbjokkfghodc
• faaegcmakhlmoheamicddkfcmmjoljnd
• amfeinhgbpnnjihjiomibeodnainnjkd
• ceoamfmlgefiljnligpdkdindckojbim
• hlacaekdajdgiiofjplpofbgebgjbnco
• lcoeefcacppckhidgmkdlnbeajkmeick
• kngkldhmcncemclgjgbbogplfeoppkll
• gfcbimjpmoeofbmnjedjfkemdinagkmp
• kmjgnidfglamdnllpoidpfikcodjapih
• heakmhbelclpalglpiceoocofnkcjefb
• gbeldgdcloiceglhpdnkhbafeoddjehm
• epjpkhahnajkdjjfkeadcgfmfjfgdohf

Bookkeeping