Top Risks

• NewTab override with uninstall URL hijack and install URL hijack — classic monetization shell pattern.
• No CSP on MV3 extension with innerHTML sinks in popup.js and calendar.js — DOM-XSS exposure.
• developer_name is empty; no 'Offered by' name visible despite verified_publisher badge.
• New-tab override with search permission elevates ad-redirect/monetization risk at scale.
• innerHTML assignments in two JS files without sanitization raise XSS risk if content sourced externally.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces every new tab for monetization.
• uninstall_url_hijack crx setUninstallURL to https://gameograf.com/?utm_source=gameograf... — 3rd-party redirect on uninstall.
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install... — opens 3rd-party URL on install.
• no_csp manifest content_security_policy is null; csp_present==false on MV3 extension with innerHTML sinks.
• dom_xss_sink crx dom_sink_innerhtml_userctrl in js/popup.js and js/calendar.js — DOM-XSS risk without CSP.
• verified_publisher store Verified publisher badge present; domain gameograf.com resolves and is not throwaway.
• privacy_policy api Policy scoped, data_collection+retention+third_party_sharing all true — adequate but shares data.
• search_engine_count api Only 1 search engine seen (google.com); no multi-engine aggregation anomaly.

Permissions Breakdown

• search medium Can read/manipulate search queries; paired with newtab override elevates risk.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain only.
• chrome_url_overrides.newtab medium Replaces new-tab page — prime real estate for ad monetization.

Pillar Scores

Bookkeeping