Top Risks

• NewTab override with uninstall URL hijack and install URL hijack — classic traffic-monetization shell pattern.
• Uninstall/install URL hijack both fire to gameograf.com with UTM tracking on every install/remove.
• Two innerHTML DOM-XSS sinks present with no CSP — elevated XSS risk from calendar/popup data.
• No developer name listed; low install count (37) with search permission and newtab override is tail-attack-surface.
• New-tab override combined with search permission enables silent search-provider monetization.

Evidence

• uninstall_url_hijack manifest setUninstallURL targets https://gameograf.com/?utm_source=extension&utm_medium=install — 3rd-party tracking.
• install_url_hijack manifest onInstalled opens https://gameograf.com/?utm_source=lofi&utm_medium=install — monetization redirect.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html replaces every new tab page.
• search_permission manifest search permission declared alongside newtab override — potential search monetization.
• dom_xss_no_csp crx Two innerHTML sinks in popup.js and calendar.js; csp_present==false amplifies XSS risk.
• verified_publisher store Publisher verified; developer domain resolves and is not throwaway — mitigates reputation concern.
• privacy_policy_adequate api Policy scoped to extension, discloses data collection, retention, and third-party sharing.
• low_installs store Only 37 installs; no rating; no developer name displayed — minimal trust signals.

Permissions Breakdown

• search medium Allows reading/modifying search queries; combined with newtab override raises monetization concern.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces every new tab — high-reach surface for monetization or search redirect.

Pillar Scores

Bookkeeping