Top Risks

• Uninstall and install URL hijacked to gameograf.com affiliate/tracking URL — monetization shell pattern.
• NewTab override intercepts every new tab open; combined with search permission enables search monetization.
• Two innerHTML DOM-XSS sinks in popup.js and calendar.js with no CSP to mitigate.
• Developer name (Dekuy.com) mismatches email domain (gameograf.com) — identity mismatch signal.
• No verified publisher, no Google featured badge; very low installs (71) with new-tab high-capability combo.

Evidence

• install_url_hijack + uninstall_url_hijack manifest Both onInstalled and uninstall redirect to gameograf.com?utm_source=dekuy — classic monetization shell.
• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — intercepts all new tabs.
• dom_sink_innerhtml_userctrl x2 crx innerHTML sinks in popup.js and calendar.js; csp_present==false amplifies XSS risk.
• no_csp manifest content_security_policy is null; MV3 default applies but dom sinks remain unmitigated.
• developer_identity_mismatch store Developer name Dekuy.com; email support@gameograf.com; privacy policy at api.gameograf.com.
• privacy_policy_classification api Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true — adequate.
• low_installs_newtab_high_cap store Only 71 installs with newtab override + search permission — tail attack surface.
• js_external_hosts crx 12 external hosts including api.gameograf.com and multiple Google services referenced in JS.

Permissions Breakdown

• search medium Allows search provider interaction; combined with newtab override increases monetization risk.
• host_permissions: https://api.gameograf.com/* medium Scoped to own API domain; enables data exfil to developer-controlled endpoint.
• chrome_url_overrides: newtab high NewTab override intercepts every new tab; monetization/redirect surface.

Pillar Scores

Bookkeeping