Top Risks

• NewTab override with uninstall+install URL hijack to gameograf.com — classic traffic-monetization shell.
• Uninstall and install URL hijacks both fire to gameograf.com with UTM tracking parameters.
• No CSP defined (csp_present=false) on MV3; DOM innerHTML sinks in popup.js and calendar.js unmitigated.
• No developer name listed; verified publisher discount applies but accountability is thin.
• New-tab search permission combo with single search engine (Google) — potential search-provider monetization.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL to https://gameograf.com/?utm_source=extension&utm_medium=install
• install_url_hijack manifest onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; captures every new tab.
• no_csp crx content_security_policy is null; MV3 default CSP applies but no explicit scope hardening.
• dom_sink_innerhtml crx Two innerHTML-from-variable sinks in popup.js and calendar.js with no CSP guard.
• verified_publisher store support@gameograf.com is a verified publisher; domain resolves, not throwaway.
• privacy_policy api Policy fetched; scoped to extension, data collection + retention + 3rd-party sharing all disclosed.
• low_install_count store Only 139 installs; no ratings. Low blast radius but monetization infrastructure still present.

Permissions Breakdown

• search medium Allows querying the browser search engine; paired with newtab override raises monetization concern.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain only.
• chrome_url_overrides.newtab medium Replaces new-tab page — high-frequency user touchpoint, monetization/redirect vector.

Pillar Scores

Bookkeeping