Top Risks

• NewTab override with install+uninstall URL hijack to developer domain — classic monetization shell pattern.
• No developer name listed; anonymous publisher with only email identity.
• Uninstall URL hijack to gameograf.com with UTM tracking confirms traffic monetization intent.
• Install URL hijack fires on onInstalled, opening 3rd-party URL for engagement tracking.
• DOM-XSS sink (innerHTML from variable) in calendar.js with no CSP; elevated exploit surface.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html; replaces every new tab with developer-controlled page.
• uninstall_url_hijack crx setUninstallURL targets https://gameograf.com/?p=33084?utm_source=extension&utm_medium=uninstall.
• install_url_hijack crx onInstalled opens https://gameograf.com/?p=33084?utm_source=extension&utm_medium=install.
• no_csp manifest content_security_policy is null (csp_present==false); MV3 but no explicit CSP declared.
• dom_xss_sink crx js/calendar.js innerHTML assigned from variable; DOM-XSS risk without CSP mitigation.
• no_developer_name store developer_name is empty string; identity relies solely on email support@gameograf.com.
• verified_publisher store Verified publisher badge present; partial trust signal but no featured badge.
• privacy_policy_adequate api Policy fetched, scoped to extension, discloses collection/retention/third-party sharing; adequate.

Permissions Breakdown

• search medium Access to search provider; combined with newtab override enables search hijack.
• alarms low Scheduling API; low standalone risk.
• storage low Local storage only; standard for settings persistence.
• chrome_url_overrides.newtab medium Replaces new-tab page; high visibility surface for monetization/redirect.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited reach.

Pillar Scores

Bookkeeping