Top Risks

• Uninstall and install URL hijack to developer's own marketing URLs — monetization/tracking signal.
• NewTab override replaces every new tab page, providing persistent reach across all browsing sessions.
• Two innerHTML DOM-XSS sinks present; no CSP to mitigate (csp_present=false).
• No developer name listed; verified publisher but missing 'Offered by' display name.
• Low install count (869) for a NewTab extension reduces trust signal despite verified publisher status.

Evidence

• uninstall_url_hijack crx setUninstallURL to gameograf.com with UTM params — marketing tracking on uninstall.
• install_url_hijack crx onInstalled opens gameograf.com with UTM install params — standard for this operator cluster.
• newtab_override manifest chrome_url_overrides.newtab present; extension controls every new tab opened by user.
• dom_sink_innerhtml crx Two innerHTML sinks in popup.js and calendar.js; no CSP defined (csp_present=false).
• verified_publisher store gameograf.com resolves, not throwaway, verified publisher badge present.
• privacy_policy_adequate api Policy is scoped, mentions data collection, retention, and third-party sharing.
• no_cve crx jquery 3.7.1 bundled — no CVEs found; cve_findings_raw empty.
• no_bad_hosts api threat_intel shows no bad_host_hits, monetization_hits, or affiliate_hits.

Permissions Breakdown

• search medium Allows querying the browser search engine; relevant for NewTab but grants search capability.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces every new tab; high reach, monetization surface.

Pillar Scores

Bookkeeping