Top Risks

• Brand impersonation: uses 'Fortnite' trademark without being a verified Epic Games entity.
• Privacy policy URL on unrelated domain (haberikra.com) failed to fetch; treated as no effective policy.
• NewTab override combined with uninstall+install URL hijack indicates monetization shell pattern.
• Privacy policy on unrelated domain (haberikra.com vs gameograf.com) raises credibility concern.
• DOM-XSS sink (innerHTML) in popup.js with no CSP present elevates code risk.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; mentions 'fortnite' but developer domain gameograf.com is not Epic Games.
• privacy_policy_fetch_failed api privacy_policy_classification.fetched=false (HTTPError on haberikra.com); scored as no effective policy (+10.0).
• newtab_override manifest chrome_url_overrides.newtab=newtab.html; every new-tab session captured.
• uninstall_url_hijack crx uninstall_url_hijack=true targeting gameograf.com with UTM params; monetization signal.
• install_url_hijack crx install_url_hijack=true targeting gameograf.com with UTM params; monetization shell pattern.
• no_csp manifest content_security_policy=null on MV3; dom_sink_innerhtml_userctrl in popup.js unmitigated.
• developer_name_missing store developer_name is empty string; reduced accountability.
• stale_15mo store months_since_update=15; maintenance score elevated (6-12mo band +3.5).

Permissions Breakdown

• search medium Allows search-provider interaction; combined with newtab override raises monetization concern.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces every new-tab page; primary monetization vector for this category.

Pillar Scores

Bookkeeping