Top Risks

• Privacy policy is Google's generic policy — does NOT scope to this extension; admits data collection and 3rd-party sharing.
• New-tab override + search provider override: monetization shell pattern with uninstall/install URL hijack to gameograf.com.
• Uninstall and install URL hijacks redirect to developer's marketing site; engagement tracking on lifecycle events.
• External JS host mlionltd.github.io is unverifiable third-party GitHub Pages endpoint — supply-chain risk.
• No CSP declared (MV3 does not auto-enforce script-src); innerHTML DOM-XSS sink in popup.js.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to index.html — replaces new tab page.
• uninstall_url_hijack crx setUninstallURL targets https://gameograf.com/?utm_source=uninstall — 3rd-party lifecycle tracking.
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install — 3rd-party redirect on install.
• privacy_policy_generic api Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• external_host_unrecognized crx js_external_hosts includes mlionltd.github.io — unverifiable GitHub Pages third party.
• dom_xss_sink crx popup.js uses innerHTML with variable — DOM-XSS risk, no CSP to mitigate.
• maintenance_stale store 16 months since last update; extension is in 12-24mo stale band.
• no_developer_name store developer_name is empty string; reduces accountability signal.

Permissions Breakdown

• search medium Allows overriding the browser search provider — monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; single origin, low breadth.
• chrome_url_overrides.newtab medium Replaces new-tab page; prime real estate for monetization/search injection.

Pillar Scores

Bookkeeping