Top Risks

• New-tab override with install+uninstall URL hijacks indicates monetization shell pattern.
• Privacy policy is Google's generic account policy — does not scope to this extension at all.
• Privacy policy fetched: admits data collection + 3rd-party sharing with no extension scope → Privacy pillar 10.
• No developer name listed; unverified publisher for a newtab/search-influencing extension.
• innerHTML DOM-XSS sinks in calendar.js and popup.js with no CSP protection.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces every new tab page.
• uninstall_url_hijack crx setUninstallURL targets https://gameograf.com/?utm_source=gameograf&utm_medium=link&utm_campaign=bg&utm_content=uninstall
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install — classic monetization shell behavior.
• generic_privacy_policy store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• no_developer_name store developer_name is empty string; not verified publisher, not featured.
• dom_xss_sinks crx innerHTML assigned from variables in calendar.js and popup.js; csp_present=false amplifies risk.
• months_since_update_13 api Last updated August 2025, 13 months ago → Maintenance +6.0 band.
• js_external_hosts_broad crx 12 external JS hosts including Google services and youtube.com embedded in newtab shell.

Permissions Breakdown

• search medium Search API enables search-provider influence; paired with newtab override elevates risk.
• chrome_url_overrides.newtab high Replaces every new tab — high reach monetization surface, scored per v2 rule (a).
• host_permissions: https://api.gameograf.com/* low Scoped to developer-controlled API domain only.

Pillar Scores

Bookkeeping