Top Risks

• NewTab override replaces every new tab — high-reach monetization surface with search permission.
• Uninstall AND install URL hijack to gameograf.com UTM-tagged pages — traffic monetization pattern.
• No developer name listed despite verified publisher status reduces accountability.
• DOM-XSS sink (innerHTML) in calendar.js with no CSP — potential content injection.
• Rating of 3.0 and very low install count (416) with no developer name raises credibility concern.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html — replaces every new tab page.
• uninstall_url_hijack crx setUninstallURL -> https://gameograf.com/?utm_source=extension&utm_medium=install
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install
• no_csp manifest content_security_policy is null; MV3 strict default applies but no explicit CSP set.
• dom_sink_innerhtml_userctrl crx js/calendar.js assigns user-controlled HTML to innerHTML — DOM-XSS risk.
• no_developer_name store developer_name is empty string despite verified_publisher == true.
• privacy_policy_adequate api Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true.
• search_engine_count_1 api Only 1 search engine seen (google.com); no multi-engine ad aggregator pattern detected.

Permissions Breakdown

• search medium Allows reading/manipulating search queries; paired with newtab override raises search-monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab — high reach, classic monetization vector.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limits exfil surface.

Pillar Scores

Bookkeeping