Top Risks

• NewTab override with install/uninstall URL hijack to gameograf.com — clear monetization shell pattern.
• Privacy policy is Google's own policy (scope_extension=false, data_collection=true, third_party_sharing=true) — not scoped to this extension.
• No developer name provided despite verified_publisher status; blank manifest name/description (__MSG__ keys only).
• Two innerHTML DOM-XSS sinks with no CSP present, elevating XSS exploitability.
• Uninstall and install URL hijack both redirect to gameograf.com UTM-tracked pages — monetization/tracking intent.

Evidence

• newtab_override_with_monetization manifest chrome_url_overrides.newtab set; uninstall_url_hijack and install_url_hijack both redirect to gameograf.com with UTM params.
• privacy_policy_generic_google store Privacy URL is Google's own policy (myaccount.google.com/privacypolicy); scope_extension=false, data_collection=true, third_party_sharing=true.
• dom_xss_no_csp crx Two innerHTML sinks in popup.js and calendar.js; csp_present=false, no content_security_policy declared.
• developer_name_missing store developer_name is empty string despite verified_publisher=true and is_featured_by_google=true.
• install_uninstall_url_hijack manifest Both onInstalled and setUninstallURL point to third-party gameograf.com with campaign tracking parameters.
• verified_publisher_featured store Extension is verified_publisher and featured by Google, partially mitigating reputation risk but not monetization concerns.
• operator_cluster_singleton api sibling_count=0; no other extensions share this fingerprint cluster.
• cve_findings_empty crx No CVEs found; jquery 3.7.1 is current and unaffected.

Permissions Breakdown

• search medium Search override capability; medium risk on its own but combined with newtab override amplifies control.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; low blast radius.
• chrome_url_overrides.newtab medium Replaces every new tab with extension page; persistent high-frequency surface for monetization or tracking.

Pillar Scores

Bookkeeping