Top Risks

• NewTab override replaces every new-tab page — primary surface for search/ad monetization.
• Uninstall and install URL hijacks redirect to gameograf.com tracking URLs.
• Two innerHTML DOM-XSS sinks with no CSP; csp_present=false amplifies risk.
• No developer name listed; 'Offered by' blank reduces accountability.
• Verified publisher discount limited: no sibling extensions but newtab monetization pattern present.

Evidence

• newtab_override manifest chrome_url_overrides.newtab=newtab.html; replaces every new-tab for 44 installs.
• uninstall_url_hijack crx setUninstallURL targets https://gameograf.com/?utm_source=extension&utm_medium=install
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install
• dom_xss_sinks crx innerHTML writes from variables in js/popup.js and js/calendar.js; no CSP present.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.
• verified_publisher store Verified publisher badge present; domain gameograf.com resolves, not throwaway.
• privacy_policy api Policy scoped, data_collection=true, retention=true, third_party_sharing=true; adequate.
• no_developer_name store developer_name is empty string; reduces accountability signal.

Permissions Breakdown

• search medium Allows reading search provider info; paired with newtab override raises monetization concern.
• https://api.gameograf.com/* medium Host permission scoped to developer's own API domain only; acceptable but still grants network access.
• chrome_url_overrides.newtab medium Replaces every new-tab page; primary monetization vector for this category.

Pillar Scores

Bookkeeping