Top Risks

• NewTab override with uninstall/install URL hijacks to gameograf.com — clear monetization shell pattern.
• Privacy policy is Google's generic account policy (not scoped to this extension), admits data collection and 3rd-party sharing.
• No CSP declared (MV3 default is strict, but csp_present==false noted); innerHTML sinks present without CSP guard.
• Developer name blank; verified publisher badge present but does not resolve privacy or monetization concerns.
• Install and uninstall URL hijacking both active — classic low-value-extension traffic monetization.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html; replaces every new-tab page for all users.
• uninstall_url_hijack crx setUninstallURL targets https://gameograf.com/?utm_source=gameograf&utm_campaign=bg — 3rd-party monetization.
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install — 3rd-party redirect on every install.
• privacy_policy_generic api Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• dom_sink_innerhtml crx Two innerHTML-from-variable sinks in popup.js and calendar.js; no CSP to mitigate DOM-XSS.
• verified_publisher store Developer is verified publisher (gameograf.com resolves, not throwaway), partially mitigates reputation risk.
• no_developer_name store developer_name is empty string; reduces accountability signal.
• low_installs store Only 204 installs; blast radius currently low but pattern is consistent monetization shell.

Permissions Breakdown

• search medium Allows search-provider influence; medium concern for a NewTab override.
• host_permissions: https://api.gameograf.com/* low Scoped to dev-controlled domain; limited blast radius.
• chrome_url_overrides: newtab medium Replaces new-tab page; monetization vector; scored per rule (a).

Pillar Scores

Bookkeeping