Top Risks

• New-tab override combined with 'search' permission enables search-engine monetization on every new tab.
• Uninstall and install URL hijacks redirect to gameograf.com tracking URLs — persistent monetization pattern.
• mlionltd.github.io in js_external_hosts is an unexpected third-party GitHub Pages domain with unknown purpose.
• Extension last updated 13 months ago — moderate staleness risk for a NewTab/search product.
• No developer name provided in store listing reduces accountability signals.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to index.html — replaces every new-tab page.
• uninstall_url_hijack crx setUninstallURL to gameograf.com with UTM tracking params — webstore +3.0.
• install_url_hijack crx onInstalled opens gameograf.com with UTM install tracking — webstore +2.0.
• external_host_anomaly crx mlionltd.github.io listed in js_external_hosts — unrecognized third-party GitHub Pages domain.
• verified_publisher store Developer has verified publisher badge; domain resolves, not throwaway.
• privacy_policy_adequate api Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true.
• dom_xss_sink crx innerHTML assigned from variable in js/popup.js — DOM-XSS risk without CSP (MV3 default applies).
• staleness store 13 months since last update — maintenance score +6.0 (12-24mo band).

Permissions Breakdown

• search medium Allows reading/setting default search engine; combined with newtab override enables search monetization.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; narrow and expected for a NewTab extension.
• chrome_url_overrides.newtab medium Replaces new-tab page — primary vector for search monetization and persistent user engagement.

Pillar Scores

Bookkeeping