Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing (D clause: +10.0 privacy pillar).
• New-tab override hijacks every new tab; uninstall and install URL hijacks to gameograf.com monetization UTM links.
• 16 months since last update triggers stale-maintenance penalty; MV3 but no CSP declared.
• Operator dev_email fingerprint shared across 7 sibling extensions — high-volume NewTab shell cluster.
• innerHTML DOM-XSS sink in popup.js with no CSP present elevates code-quality risk.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to index.html — replaces every new tab.
• uninstall_url_hijack crx setUninstallURL targets https://gameograf.com/?utm_source=uninstall — 3rd-party monetization.
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install — monetization redirect.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• operator_cluster_siblings api dev_email info@gameograf.com shared by 7 extensions — NewTab shell cluster fingerprint.
• stale_maintenance store 16 months since last update — maintenance score elevated to 6.0.
• dom_xss_sink crx innerHTML user-controlled assignment in js/popup.js with csp_present=false.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.

Permissions Breakdown

• search medium Allows querying and potentially overriding search provider behavior.
• host_permissions: https://api.gameograf.com/* low Scoped to dev-controlled API domain only.
• chrome_url_overrides.newtab medium Replaces every new tab with extension page — monetization surface.

Pillar Scores

Operator Siblings (4)

Other extensions sharing this developer's compound fingerprint:

• gimhgipihjkolgkmpffjccnlljanjdcd
• apieggaibpegfepedgdobiphmhpkjlam
• aedeehoenniimfpfffnfmjgbcmcdbboh
• hndiddblhijokmfbhmfgdmeeiddjnbme

Bookkeeping