Top Risks

• NewTab override hijacks every new tab; operator cluster of 10+ siblings signals mass-deployment monetization shell.
• Privacy policy URL unreachable (fetch_error) — effectively no policy; scored as no policy (+10.0).
• Uninstall and install URL hijacks redirect to gameograf.com tracking URLs.
• Operator cluster: 48 extensions share same dev email, 16 share uninstall URL — coordinated wallpaper farm.
• Two innerHTML DOM-XSS sinks without CSP; no content_security_policy declared (MV3 default applies but no explicit hardening).

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html — replaces every new tab for all 329 users.
• uninstall_url_hijack manifest setUninstallURL → https://gameograf.com/?utm_source=extension&utm_medium=install (3rd-party tracking).
• install_url_hijack manifest onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install.
• operator_cluster api sibling_count=10 compound; 48 extensions share dev email — coordinated wallpaper monetization farm.
• privacy_policy_unreachable api fetch_error:ConnectionError on https://api.gameograf.com/gameograf-privacy-policy.html — treated as no policy.
• dom_xss_sinks crx innerHTML from variable in popup.js and calendar.js; no CSP declared — elevated DOM-XSS risk.
• no_developer_name store developer_name is empty string; identity accountability reduced.
• verified_publisher store Verified publisher badge present (gameograf.com resolves, age 2051 days) — partial reputation credit.

Permissions Breakdown

• search medium Allows reading/overriding search provider; medium risk in context of NewTab override.
• host_permissions: https://api.gameograf.com/* low Scoped to own API domain only; limited blast radius.
• chrome_url_overrides.newtab medium Replaces every new tab — persistent, high-reach surface; monetization vector.

Pillar Scores

Operator Siblings (15)

Other extensions sharing this developer's compound fingerprint:

• fdjpcjggpgdmdikmhoagohakklihimbo
• ammndifopdgpjcpmpbdenfcafipnejlj
• ojhigfemmjpjnmhidflhdlcahgdiiija
• ieocbmlfbinpcffofcjmpbjokkfghodc
• faaegcmakhlmoheamicddkfcmmjoljnd
• amfeinhgbpnnjihjiomibeodnainnjkd
• ceoamfmlgefiljnligpdkdindckojbim
• hlacaekdajdgiiofjplpofbgebgjbnco
• lcoeefcacppckhidgmkdlnbeajkmeick
• kngkldhmcncemclgjgbbogplfeoppkll
• kmjgnidfglamdnllpoidpfikcodjapih
• heakmhbelclpalglpiceoocofnkcjefb
• gbeldgdcloiceglhpdnkhbafeoddjehm
• epjpkhahnajkdjjfkeadcgfmfjfgdohf
• fjmlhfejlohohljeioedcliggbfkihdf

Bookkeeping