Top Risks

• Google account privacy policy used — not scoped to this extension; data_collection+third_party_sharing admitted without extension context.
• NewTab override replaces every new tab; uninstall and install URL hijacks redirect to developer site with UTM tracking.
• No developer name listed; privacy policy is Google's generic policy, not extension-specific.
• Stale 16 months with NewTab override — monetization shape with limited accountability.
• innerHTML DOM sink in popup.js without CSP — XSS risk if variable is user-/network-controlled.

Evidence

• newtab_override manifest chrome_url_overrides.newtab=newtab.html replaces every new tab page.
• uninstall_url_hijack crx setUninstallURL targets gameograf.com with UTM campaign tracking on uninstall.
• install_url_hijack crx onInstalled opens gameograf.com with UTM campaign tracking on install.
• generic_privacy_policy store Privacy URL is Google's account policy (myaccount.google.com) — scope_extension=false, data_collection=true, third_party_sharing=true.
• no_developer_name store developer_name is empty string; reduces accountability.
• dom_xss_sink crx innerHTML assigned from variable in popup.js without CSP protection.
• stale_newtab store 16 months since update; NewTab+search override pattern with install/uninstall hijack = monetization shell fingerprint.
• verified_publisher store Verified publisher badge present for gameograf.com; domain resolves, not throwaway.

Permissions Breakdown

• search medium Allows querying browser search; paired with newtab override raises search-monetization concern.
• chrome_url_overrides.newtab high Replaces every new tab — high reach, enables search redirection and ad injection.
• host_permissions: https://api.gameograf.com/* medium Scoped to own API domain; enables data exfiltration to developer-controlled endpoint.

Pillar Scores

Bookkeeping