Top Risks

• NewTab override with search permission = search monetization surface.
• Uninstall and install URL hijacks redirect to developer domain (tracking).
• No CSP declared (MV3 default applies, but dom_sink_innerhtml_userctrl present in popup.js).
• Extension updated 14 months ago — no recent maintenance signal.
• Developer name field empty; low install count (169) limits blast radius but reduces accountability.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces new-tab page for all users.
• uninstall_url_hijack crx setUninstallURL points to gameograf.com with UTM tracking params.
• install_url_hijack crx onInstalled opens gameograf.com with UTM install tracking params.
• dom_sink_innerhtml_userctrl crx popup.js assigns variable to innerHTML — DOM-XSS risk with no CSP.
• verified_publisher store Developer verified on Chrome Web Store; domain resolves, not throwaway.
• privacy_policy_adequate api Policy fetched, scoped to extension, discloses collection, retention, and third-party sharing.
• maintenance_stale store Last updated June 2025 — 14 months ago, falling in 12-24mo band (+6.0 maintenance).
• low_installs store Only 169 installs; limits blast radius but also limits accountability signals.

Permissions Breakdown

• search medium Allows reading/modifying search queries; paired with newtab override raises monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to developer-controlled API domain only.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary vector for search monetization in this category.

Pillar Scores

Bookkeeping