Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Horizon sky wanderer [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override replaces every new tab — high-reach monetization surface with uninstall/install URL hijack to gameograf.com.
• Uninstall and install URL hijacks redirect to UTM-tagged gameograf.com — classic traffic-monetization pattern.
• No developer name listed; low-install shell with NewTab override matches game-portal/monetization shell fingerprint.
• Two innerHTML DOM-XSS sinks with no CSP — content injected from API could be exploited if API is compromised.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL to https://gameograf.com/?utm_source=dekuy&utm_medium=dekuy — monetization redirect.
• install_url_hijack manifest onInstalled opens https://gameograf.com/?utm_source=dekuy&utm_medium=dekuy — UTM-tagged traffic capture.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html — replaces every new tab for all users.
• no_developer_name store developer_name is empty; no verified publisher badge; only 7 installs.
• dom_xss_sinks_no_csp crx Two innerHTML assignments from variables in popup.js and calendar.js; csp_present==false.
• placeholder_manifest manifest manifest_name and manifest_description are __MSG__ placeholders — store listing obfuscation.
• privacy_policy_scope api Policy fetched, scope_extension=true, data_collection=true, retention=true, third_party_sharing=true — adequate.
• search_engine_count_1 api Only google.com seen as search engine; no multi-engine monetization aggregator pattern detected.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Horizon sky wanderer [adware] + malext.io malicious_extension_sentry; score 4.44 -> 6.94 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding or querying the browser search API; paired with NewTab override raises monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces every new tab — primary monetization/data surface for this category.

Pillar Scores

Bookkeeping