Top Risks

• NewTab override with search permission creates broad monetization/tracking surface on every new tab.
• Privacy policy is Google's own policy (not scoped to this extension); admits data collection and 3rd-party sharing — scores maximum privacy risk.
• Uninstall and install URL hijacking to gameograf.com with UTM tracking parameters.
• External JS host mlionltd.github.io (github.io CDN) loaded without CSP — remote code injection risk.
• 16 months since last update with no CSP and innerHTML DOM sink — elevated staleness risk.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = index.html — replaces every new tab for all users.
• privacy_policy_generic_google store Policy URL is Google's account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• uninstall_url_hijack crx setUninstallURL points to gameograf.com with UTM tracking params.
• install_url_hijack crx onInstalled opens gameograf.com with UTM tracking params.
• external_js_github_io crx mlionltd.github.io listed as external JS host; no CSP to restrict remote script loading.
• dom_sink_innerhtml crx js/popup.js assigns user-controlled variable to innerHTML with no CSP mitigations.
• stale_no_csp manifest 16 months since update, csp_present=false, MV3 but no explicit CSP declared.
• new_tab_monetization_pattern store Wallpaper/NewTab shell with search override, install/uninstall URL hijack — classic traffic monetization cluster.

Permissions Breakdown

• search medium Allows overriding search provider; combined with newtab override creates monetization surface.
• host_permissions: https://api.gameograf.com/* medium Scoped to developer API; enables data exfiltration to dev-controlled endpoint.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; high reach monetization/surveillance vector.

Pillar Scores

Bookkeeping