Top Risks

• NewTab override replaces every new tab page for 2K users — persistent reach for search/ad monetization.
• Privacy policy is Google's own policy, not scoped to this extension — data_collection+third_party_sharing admitted without extension scope; scores as +10 per D rule.
• Brand impersonation: uses 'Minecraft' branding without confirmed ownership of IP — unverified.
• Uninstall and install URL hijacking to gameograf.com tracking URLs — monetization-shell fingerprint.
• innerHTML sink in popup.js without CSP increases DOM-XSS risk.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = index.html; search permission declared — classic newtab monetization shape.
• privacy_policy_generic store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not extension-scoped; scope_extension=false, data_collection=true, third_party_sharing=true.
• brand_impersonation store brand_mention.is_impersonation=true for 'minecraft'; developer domain gameograf.com is not confirmed Minecraft IP owner.
• uninstall_install_url_hijack crx Both onInstalled and onUninstalled redirect to gameograf.com with UTM tracking params — monetization shell indicator.
• dom_xss_sink crx js/popup.js uses innerHTML with user-controlled variable; no CSP present on MV3 extension.
• no_developer_name store developer_name is empty string; no verified business name displayed.
• stale_16mo store months_since_update=16; triggers v2 0c cap on verified-publisher discount (>18mo threshold not met, but 16mo noted).
• external_host_mlionltd_github crx js_external_hosts includes mlionltd.github.io — third-party GitHub Pages host outside developer domain, unexplained.

Permissions Breakdown

• search medium Allows search provider override; combined with newtab override creates search monetization surface.
• host_permissions: https://api.gameograf.com/* medium Scoped to developer API but enables data exfil from newtab context.
• chrome_url_overrides.newtab high Replaces every new tab — high-reach monetization vector per rubric v2 rule (a).

Pillar Scores

Bookkeeping