Top Risks

• New-tab override replaces every new tab — high-reach monetization surface with search override permission.
• Privacy policy is Google's own policy (generic, unscoped) — admits data collection and 3rd-party sharing without extension-specific disclosure.
• Uninstall and install URL hijacks redirect to gameograf.com tracking UTM links — monetization fingerprint.
• External JS host mlionltd.github.io is a third-party GitHub Pages domain with no clear ownership link to developer.
• No CSP defined; DOM-XSS sink (innerHTML) in popup.js increases XSS exposure if external data is injected.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab for all users.
• uninstall_url_hijack crx setUninstallURL targets gameograf.com with UTM tracking params.
• install_url_hijack crx onInstalled opens gameograf.com with UTM tracking params.
• generic_privacy_policy store Privacy URL is Google's own policy (myaccount.google.com); scope_extension=false, data_collection=true, third_party_sharing=true.
• external_host_third_party crx mlionltd.github.io listed as JS external host — not dev-controlled domain.
• dom_xss_sink crx innerHTML assigned from variable in js/popup.js; no CSP to mitigate.
• search_override_permission manifest search permission declared alongside newtab override — dual monetization vector.
• stale_16mo store Last updated 16 months ago; within 12-24mo band (+6.0 maintenance).

Permissions Breakdown

• search medium Allows overriding search provider; enables monetization via search hijacking.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary surface for ad/monetization injection.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.

Pillar Scores

Bookkeeping