Top Risks

• NewTab override with search permission — classic ad-monetization shell; 12 sibling extensions under same operator fingerprint.
• Privacy policy URL returns connection error (fetch_error) — effectively no accessible policy; scored as unfetched.
• Uninstall and install URL hijack both redirect to gameograf.com UTM tracking link.
• Operator cluster of 50 dev-email siblings and 12 compound-fingerprint siblings suggests factory-pattern extension farm.
• Two innerHTML DOM-XSS sinks with no CSP present elevates XSS risk on new-tab page.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html; search permission declared — monetization-shape NewTab.
• uninstall_install_url_hijack manifest Both onInstalled and uninstall URL redirect to https://gameograf.com/?utm_source=extension&utm_medium=install.
• operator_cluster store sibling_count=12 compound, 50 by dev_email; factory-pattern extension portfolio under gameograf.com.
• privacy_policy_fetch_error api privacy_policy_classification.fetched=false; ConnectionError on api.gameograf.com — policy inaccessible.
• dom_xss_no_csp crx Two innerHTML sinks in popup.js and calendar.js; csp_present=false, no mitigating CSP on MV3 extension.
• no_developer_name store developer_name is empty string; reduces accountability.
• verified_publisher store verified_publisher=true; applies -3.0 to reputation but capped at -1.0 due to monetization install/uninstall hijack.
• search_engine_count_1 api Only google.com seen; no multi-search-engine anomaly, but search permission + newtab still risky.

Permissions Breakdown

• search medium Allows reading/modifying search provider; paired with newtab override raises monetization concern.
• chrome_url_overrides.newtab high Replaces new-tab page — primary monetization surface for ad/search injection.
• host_permissions: https://api.gameograf.com/* low Scoped to dev's own API domain; limited blast radius.

Pillar Scores

Operator Siblings (15)

Other extensions sharing this developer's compound fingerprint:

• fdjpcjggpgdmdikmhoagohakklihimbo
• ammndifopdgpjcpmpbdenfcafipnejlj
• ojhigfemmjpjnmhidflhdlcahgdiiija
• ieocbmlfbinpcffofcjmpbjokkfghodc
• faaegcmakhlmoheamicddkfcmmjoljnd
• amfeinhgbpnnjihjiomibeodnainnjkd
• ceoamfmlgefiljnligpdkdindckojbim
• hlacaekdajdgiiofjplpofbgebgjbnco
• lcoeefcacppckhidgmkdlnbeajkmeick
• kngkldhmcncemclgjgbbogplfeoppkll
• gfcbimjpmoeofbmnjedjfkemdinagkmp
• kmjgnidfglamdnllpoidpfikcodjapih
• gbeldgdcloiceglhpdnkhbafeoddjehm
• epjpkhahnajkdjjfkeadcgfmfjfgdohf
• fjmlhfejlohohljeioedcliggbfkihdf

Bookkeeping