Top Risks

• NewTab override: replaces every new tab, primary ad/monetization surface for wallpaper shells.
• Uninstall & install URL hijack to gameograf.com — traffic monetization pattern.
• Two DOM-XSS innerHTML sinks with no CSP to mitigate; csp_present==false amplifies risk.
• No developer name listed despite verified_publisher status; reduces accountability signal.
• Low install count (145) with broad newtab+search capability is a tail-attack-surface concern.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html; replaces every new tab page.
• uninstall_url_hijack crx setUninstallURL points to https://gameograf.com/?utm_source=extension&utm_medium=install
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install
• dom_xss_sinks crx innerHTML from variable in js/popup.js and js/calendar.js; no CSP present.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• verified_publisher store verified_publisher=true; domain gameograf.com resolves; not throwaway.
• privacy_policy_classification api Policy fetched, scoped, discloses collection/retention/3rd-party sharing — adequate.
• low_installs_newtab store Only 145 installs for a newtab wallpaper extension; growth vector still open.

Permissions Breakdown

• search medium Allows reading/modifying search queries; medium risk in newtab context.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain only.
• chrome_url_overrides.newtab medium Replaces every new tab — primary monetization/control vector for this category.

Pillar Scores

Bookkeeping