Top Risks

• NewTab override with uninstall/install URL hijack to developer domain — monetization shell pattern.
• Privacy policy is Google's own policy (not extension-scoped) but admits data collection and 3rd-party sharing.
• bit.ly affiliate/cloaking hit in js_external_hosts; links to mlionltd.github.io unverified third-party.
• No CSP (csp_present=false) on MV3 extension with innerHTML DOM-XSS sink in popup.js.
• 16 months since last update — stale for a NewTab extension handling search overrides.

Evidence

• uninstall_url_hijack + install_url_hijack crx Both onInstall and onUninstall redirect to gameograf.com with UTM params — monetization shell pattern (+2+3 webstore).
• newtab_override manifest chrome_url_overrides.newtab set to index.html; NewTab-override-with-monetization shape.
• privacy_policy_generic_google store Policy URL is myaccount.google.com/privacypolicy — not extension-scoped; data_collection=true, third_party_sharing=true → +10 privacy.
• affiliate_hit_bitly crx bit.ly in js_external_hosts flagged as affiliate/cloaking redirector.
• dom_xss_sink crx innerHTML assigned from variable in js/popup.js with no CSP — DOM-XSS risk.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• stale_extension store 16 months since last update; 6-12mo band (+3.5 maintenance).
• no_developer_name store developer_name is empty string; adds to reputation risk (+1.0 no Offered-by).

Permissions Breakdown

• search medium Allows reading/modifying search provider; medium risk in a NewTab extension.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary delivery mechanism for monetization/tracking.

Pillar Scores

Bookkeeping