Top Risks

• Privacy policy is Google's own policy (scope_extension=false, data_collection=true, third_party_sharing=true) — worst-case generic policy per v3.5 rule D.
• Broad host access (*://*/*) + scripting permission allows reading/modifying every page the user visits.
• Uninstall URL hijack sends users to gameograf.com on removal — monetization/tracking signal.
• Install URL hijack opens gameograf.com on install — additional monetization signal.
• No developer name listed; privacy policy is Google's generic account policy, not scoped to this extension.

Evidence

• privacy_policy_generic_google store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL targets https://gameograf.com/cristiano-ronaldo-cursor/.
• install_url_hijack crx onInstalled opens https://gameograf.com/cristiano-ronaldo-cursor/.
• broad_host_plus_scripting manifest host_permissions *://*/* combined with scripting permission — full page read/write on all sites.
• dom_xss_sink crx innerHTML assigned from variable in 2 JS files; no CSP present — elevated XSS risk.
• no_csp manifest content_security_policy is null; csp_present=false — no script injection mitigation.
• no_developer_name store developer_name field is empty; only email support@gameograf.com available.
• verified_publisher store verified_publisher=true; partially offsets reputation risk but does not explain privacy policy deficiency.

Permissions Breakdown

• storage low Standard key-value persistence; low standalone risk.
• unlimitedStorage low Allows larger local storage quota; minimal direct privacy risk.
• scripting high Enables dynamic script injection into any page via host_permissions *://*/*.
• *://*/* (host_permissions) high Broad host access across all URLs; pairs with scripting for full page control.
• *://*/* (content_scripts_matches) high Content scripts auto-injected into every site the user visits.

Pillar Scores

Bookkeeping