Top Risks

• NewTab override replaces every new tab; uninstall+install URL hijacks confirm monetization intent.
• 14 months since last update — stale for an active NewTab product.
• DOM-XSS sink (innerHTML from variable) in popup.js with no CSP present.
• No developer name listed; verified publisher but low accountability signal.
• Search permission allows observation of user search queries via the new-tab surface.

Evidence

• newtab_override manifest chrome_url_overrides.newtab replaces every new-tab page — high-reach monetization surface.
• uninstall_url_hijack crx setUninstallURL to https://gameograf.com/?utm_source=gameograf — confirmed monetization hijack pattern.
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install — install redirect to 3rd-party URL.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP hardens the extension.
• dom_xss_sink crx js/popup.js: innerHTML assigned from variable — DOM-XSS sink without CSP mitigation.
• stale_update store Last updated June 6 2025 — 14 months ago; active NewTab should update more frequently.
• verified_publisher store Verified publisher badge present; domain resolves; not throwaway.
• privacy_policy_adequate api Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true.

Permissions Breakdown

• search medium Allows querying the browser's default search — relevant for NewTab but can observe search terms.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces every new-tab page; high-reach surface for monetization or data collection.

Pillar Scores

Bookkeeping