Top Risks

• Google privacy policy used as extension policy — admits data collection and 3rd-party sharing with no extension scope.
• Operator cluster: 27 sibling extensions under same developer email; mass NewTab monetization factory.
• Both install and uninstall URL hijacks redirect users to gameograf.com tracking URLs.
• NewTab override with search permission and developer email tracking 26-extension install-URL pattern.
• DOM-XSS innerHTML sink in popup.js without CSP protection.

Evidence

• privacy_policy_google_generic store Policy URL is Google's own policy (scope_extension=false, data_collection=true, third_party_sharing=true) → +10.0 privacy per v3.5 rule D.
• operator_cluster_siblings api sibling_count=5 compound; dev_email matches 27 extensions. Mass NewTab shell factory pattern.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com UTM tracking. +3.0 webstore.
• install_url_hijack crx onInstalled opens gameograf.com UTM tracking URL. +2.0 webstore.
• newtab_override_search_permission manifest chrome_url_overrides.newtab + search permission combo; NewTab monetization shell pattern.
• dom_sink_no_csp crx innerHTML sink in popup.js; csp_present=false on MV3 extension. DOM-XSS risk.
• maintenance_stale store months_since_update=16; 12-24mo band → +6.0 maintenance.
• no_developer_name store developer_name is empty string; verified_publisher=true but no displayed name.

Permissions Breakdown

• search medium Allows overriding search provider; medium risk for NewTab/search-redirect monetization.
• host_permissions: https://api.gameograf.com/* low Scoped to own API domain; low risk but enables outbound data calls.
• chrome_url_overrides.newtab medium Replaces every new tab page; high-reach surface for monetization and data collection.

Pillar Scores

Operator Siblings (6)

Other extensions sharing this developer's compound fingerprint:

• pikefoaagadfjcgbhgdhdboefoohdpbe
• onjaegfaigiefjodacjpeigblaifalab
• iofncbfmmdjkbalfhneppkeglboddgfl
• daaiminpbfdcmdacaomdnemceoillghm
• bdgjlkghndpkfhfhpdgeabcfnkjanagl
• ediemaoaclggogobngcpcfdanoakkpga

Bookkeeping