Top Risks

• NewTab override replaces every new tab, enabling persistent search/traffic monetization for all users.
• Uninstall URL hijack redirects users to gameograf.com on removal — traffic monetization signal.
• Install URL hijack opens gameograf.com on install — onboarding monetization.
• No CSP declared (MV3 default only); innerHTML DOM-XSS sink in popup.js without policy hardening.
• No developer name listed; verified publisher status present but no organic install base (610 installs).

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html — replaces every new tab page for all users.
• uninstall_url_hijack crx setUninstallURL points to gameograf.com with UTM params — traffic monetization on removal.
• install_url_hijack crx onInstalled opens gameograf.com with UTM params — monetization on install.
• dom_xss_sink crx popup.js: popupContainer.innerHTML = html; no CSP present to mitigate DOM-XSS.
• no_developer_name store developer_name is empty string; identity accountability reduced.
• verified_publisher store Extension holds verified publisher badge; partial reputation credit applied.
• privacy_policy_adequate api Policy is scoped, mentions data collection, retention, and third-party sharing — fully scored.
• low_installs_newtab store Only 610 installs for a newtab wallpaper; limited blast radius currently.

Permissions Breakdown

• search medium Allows reading/overriding search behavior; combined with newtab override elevates risk.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain only.
• chrome_url_overrides.newtab medium Replaces every new tab — high reach, monetization surface, search-provider influence.

Pillar Scores

Bookkeeping