Top Risks

• Uninstall URL hijack redirects to developer site with UTM tracking on every uninstall.
• Install URL hijack opens developer site on every install — monetization/tracking pattern.
• NewTab override with 'search' permission enables search-query interception and monetization.
• No CSP present on MV3 extension with innerHTML DOM sink — XSS risk in calendar widget.
• Developer name empty; no recognized-org verification despite verified_publisher badge.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL to gameograf.com with UTM params — traffic monetization signal.
• install_url_hijack manifest onInstalled opens gameograf.com with UTM params — monetization/affiliate shell pattern.
• newtab_override manifest chrome_url_overrides.newtab set to newtab.html; combined with 'search' permission.
• csp_absent crx content_security_policy is null; dom_sink_innerhtml_userctrl found in calendar.js.
• verified_publisher store Publisher verified; developer domain resolves; no throwaway signals.
• privacy_policy_classification api Policy fetched, scoped, data_collection=true, retention=true, third_party_sharing=true.
• no_bad_hosts_or_cves api bad_host_hits empty, cve_findings_raw empty, monetization_hits empty, affiliate_hits empty.
• developer_name_missing store developer_name is empty string; no 'Offered by' identity visible.

Permissions Breakdown

• search medium Allows reading search queries; concerning paired with newtab override.
• alarms low Schedules background tasks; low standalone risk.
• storage low Local data persistence only.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary mechanism for this wallpaper/monetization shell.

Pillar Scores

Bookkeeping