Top Risks

• NewTab override replaces browser homepage — high-reach monetization/tracking surface for 119 users.
• Privacy policy is Google's own policy (not scoped to this extension) — data collection and 3rd-party sharing admitted without extension scope.
• Uninstall and install URL hijacks redirect to gameograf.com with UTM tracking — classic monetization shell pattern.
• No developer name listed; no CSP defined for MV3 extension with innerHTML DOM sinks.
• DOM-XSS sinks (innerHTML from variables) in popup.js and calendar.js with no CSP to mitigate.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — overrides browser new-tab page.
• uninstall_url_hijack crx setUninstallURL targets https://gameograf.com/?utm_source=extension&utm_medium=install.
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=Sukuna&utm_medium=install.
• privacy_policy_generic api Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• dom_xss_sink crx innerHTML assignments in popup.js and calendar.js with no CSP — DOM-XSS risk.
• no_developer_name store developer_name is empty string; reduces accountability.
• no_csp manifest content_security_policy is null; MV3 but no explicit CSP defined.
• verified_publisher store verified_publisher=true via support@gameograf.com; gameograf.com resolves.

Permissions Breakdown

• search medium Can override search provider — monetization vector for NewTab extensions.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain only.
• chrome_url_overrides.newtab medium Replaces browser new-tab page — primary monetization/tracking surface.

Pillar Scores

Bookkeeping