Top Risks

• NewTab override replaces every new tab — high-reach monetization/tracking surface.
• Uninstall and install URL hijacks route users to gameograf.com campaign URLs.
• innerHTML sink in calendar.js is a DOM-XSS vector with no CSP to mitigate it.
• No CSP (MV3 default) means XSS in the new-tab page runs in an extension context.
• Developer name field is blank; identity accountability is limited to email domain.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html — replaces every new tab for all 1,000 users.
• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?p=33163?utm_source=extension&utm_medium=uninstall
• install_url_hijack crx onInstalled opens https://gameograf.com/?p=33163?utm_source=extension&utm_medium=install
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• dom_xss_sink crx dom_sink_innerhtml_userctrl in js/calendar.js — variable-fed innerHTML with no CSP guard.
• verified_publisher store Extension carries verified_publisher=true; discount applied but no featured badge.
• privacy_policy_scoped api Policy fetched; scope_extension=true, data_collection=true, retention=true, 3rd-party sharing=true.
• no_developer_name store developer_name is empty string; only email domain provides identity anchor.

Permissions Breakdown

• search medium Allows reading/manipulating search queries; notable for a wallpaper extension.
• alarms low Scheduling only; low standalone risk.
• storage low Local data persistence; standard, low risk.
• chrome_url_overrides.newtab medium Replaces every new tab — high-reach real-estate for monetization or tracking.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; not broad.

Pillar Scores

Bookkeeping