Top Risks

• Privacy policy URL returns HTTP error — policy effectively unavailable, treated as no policy.
• NewTab override with install/uninstall URL hijacks and operator cluster of 20+ siblings — monetization shell pattern.
• Uninstall URL hijack redirects to gameograf.com with UTM tracking params.
• Two innerHTML DOM-XSS sinks with no CSP, amplifying XSS risk from API responses.
• Operator cluster: 20 extensions share same dev email; classic game-portal fan-content shell pattern.

Evidence

• privacy_policy_fetch_failed api privacy_policy_classification.fetched==false (HTTPError); scored as no policy → Privacy +10.0.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL to gameograf.com with UTM params → Webstore +3.0.
• install_url_hijack crx onInstalled opens gameograf.com with UTM params → Webstore +2.0.
• newtab_override manifest chrome_url_overrides.newtab set → Webstore +2.0 new-tab monetization shape.
• operator_cluster api sibling_count=3 compound; dev_email cluster=20 siblings → Webstore +2.5.
• dom_sink_innerhtml_userctrl crx Two innerHTML sinks in popup.js and calendar.js; no CSP → Code Quality +2.0 each trigger.
• no_developer_name store developer_name is empty string → Reputation +1.0.
• verified_publisher store verified_publisher=true → Reputation -3.0 (capped at -1.0 per 0c: monetization pattern detected).

Permissions Breakdown

• search medium Allows overriding default search provider; medium risk for a NewTab extension.
• host_permissions: https://api.gameograf.com/* low Scoped to developer-controlled API domain only.
• chrome_url_overrides.newtab medium Replaces new-tab page — primary monetization/data-collection surface for this category.

Pillar Scores

Operator Siblings (15)

Other extensions sharing this developer's compound fingerprint:

• kbbpgbdclanolnidddbeolaaddllgebp
• kgdahhodabbdnkkphjpneoiadhdphhna
• dihbfoicmibapnfojehonedckdjhegbe
• cdmooeifaodbcailnibfpnmbighehpkj
• pjbnoadhjobchdjkfhpehlbigakbjfii
• iobnmhnecelingbpdadgpmalbdagjbnb
• jpmpdfcaaelghoomjgdebmoekdfkhabp
• ohpdpicjlgbpihginhijhkfdcgfbffgf
• cifonlmfhnimmghojdepepjdgbbminel
• dbomdodikcfpocimcpegpbnlmankljcb
• dmdfahkplmikmlboodadelolcmbjgmff
• ckodcbbdgmpjidpfcipfobfagemmfapi
• kbolkhdnpodncbepmdejjijgkdpedgcj
• gfbhidjkgiaopiekkefehamhcmigdcna
• ekmpmfdhakdjaaifkfgpbcagdhlbamki

Bookkeeping