Top Risks

• NewTab override replaces every new tab with monetization-linked page (install/uninstall URL hijack to gameograf.com).
• Uninstall and install URL hijacking both active — traffic-monetization shell pattern.
• No CSP declared (csp_present=false, MV3); innerHTML DOM-XSS sink in popup.js without CSP guard.
• No developer name listed; extension is a low-install wallpaper theme with search permission and newtab override.
• 14 months since last update — stale; maintenance risk elevated.

Evidence

• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?utm_source=gameograf&utm_medium=link&utm_campaign=bg&utm_content=uninstall
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install&utm_medium=link&utm_campaign=bg&utm_content=install
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; every new tab controlled by extension.
• no_csp manifest content_security_policy is null; MV3 default CSP applies but no explicit hardening declared.
• dom_xss_sink crx js/popup.js: innerHTML assigned from variable without sanitization — DOM-XSS risk.
• stale_extension store Last updated June 28, 2025 — 14 months since update; maintenance risk band 6-12mo.
• verified_publisher store Verified publisher badge present; discount applied to reputation pillar.
• privacy_policy_scoped api Policy at gameograf.com covers extension, data collection, retention, and third-party sharing — adequate.

Permissions Breakdown

• search medium Allows reading search queries and overriding search behavior; paired with newtab override raises monetization concern.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces every new tab — high-reach surface for ad/monetization injection.

Pillar Scores

Bookkeeping