Top Risks

• NewTab override hijacks every new tab — high monetization/redirect surface with uninstall/install URL hijacking.
• Privacy policy URL (haberikra.com) failed to fetch — effective no-policy state, score +10.
• Uninstall and install URL hijacks confirmed, routing to gameograf.com utm-tracked URLs.
• No CSP declared (MV3 default mitigates partially) combined with innerHTML DOM-XSS sink in popup.js.
• Developer name missing; privacy policy hosted on unrelated domain (haberikra.com vs gameograf.com).

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — captures all new tab navigations.
• uninstall_url_hijack crx setUninstallURL to https://gameograf.com/?utm_source=gameograf&utm_campaign=bg&utm_content=uninstall
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install&utm_campaign=bg&utm_content=install
• privacy_policy_fetch_failed api Privacy policy at haberikra.com returned HTTPError — treated as no policy.
• no_developer_name store developer_name is empty string; policy URL domain differs from developer domain.
• dom_xss_sink crx innerHTML assigned from variable in js/popup.js — DOM-XSS risk, no CSP to mitigate.
• stale_extension store 15 months since update — 12-24mo band, +6.0 maintenance score.
• verified_publisher_cap store Verified publisher but months_since_update=15 (>12mo) — v3.5(E) caps discount to -1.0.

Permissions Breakdown

• search medium Search API allows overriding default search engine — monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to developer-controlled API domain only.
• chrome_url_overrides.newtab medium NewTab override captures all new tab events — high-visibility monetization surface.

Pillar Scores

Bookkeeping