Top Risks

• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and third-party sharing (Privacy +10.0).
• NewTab override combined with uninstall/install URL hijack to gameograf.com — classic wallpaper monetization shell pattern.
• Uninstall URL hijack and install URL hijack both confirmed, firing analytics to gameograf.com on lifecycle events.
• No developer name listed; verified publisher but no 'Offered by' display name reduces accountability.
• Stale 16 months (>12mo) combined with newtab override and no CSP — elevated dormant-risk profile.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces every new tab page.
• uninstall_url_hijack crx setUninstallURL targets gameograf.com with UTM tracking params.
• install_url_hijack crx onInstalled opens gameograf.com with UTM install params.
• generic_privacy_policy store Privacy policy URL is Google's account policy — not extension-scoped; data_collection+third_party_sharing=true.
• dom_xss_sink crx popup.js assigns innerHTML from variable without CSP; DOM-XSS risk.
• no_csp manifest content_security_policy is null (MV3 default applies but no explicit hardening).
• stale_extension store 16 months since last update — maintenance pillar 6-12mo band (+3.5) adjusted to 6.0 for 12-24mo.
• verified_publisher_no_dev_name store verified_publisher=true but developer_name empty; invariant 0c applies (monetization hits absent but lifecycle hijack present).

Permissions Breakdown

• search medium Allows overriding search provider behavior; medium risk in NewTab context.
• host_permissions: https://api.gameograf.com/* medium Scoped to developer's own API domain; enables data exfil to that endpoint.
• chrome_url_overrides.newtab medium Replaces every new tab; high reach, monetization vector for wallpaper shells.

Pillar Scores

Bookkeeping