Top Risks

• New-tab override enables search monetization and persistent page replacement for 261 users.
• Privacy policy URL is on a different domain (haberikra.com) and was unreachable — treated as no policy.
• Uninstall and install URL hijacks redirect to developer UTM-tracked pages — monetization pattern.
• No CSP present (MV3 default applied but csp_present==false) with innerHTML DOM-XSS sink in popup.js.
• Developer name is blank and privacy policy domain differs from developer domain — low accountability.

Evidence

• newtab_override manifest chrome_url_overrides.newtab=newtab.html replaces every new tab; search_engine_count=1 (google.com).
• uninstall_url_hijack crx setUninstallURL targets https://gameograf.com/?utm_source=gameograf&utm_campaign=bg&utm_content=uninstall
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install&utm_campaign=bg&utm_content=install
• privacy_policy_fetch_failed api Privacy policy at haberikra.com returned HTTPError; treated as fetched==false → score +10.0.
• dom_xss_sink crx popup.js assigns innerHTML from variable with no CSP guard — DOM-XSS risk.
• no_developer_name store developer_name is empty string; accountability gap despite verified_publisher=true.
• verified_publisher store verified_publisher=true; mitigates reputation somewhat but capped due to months_since_update=15 (>12).
• maintenance_stale store months_since_update=15; falls in 12-24mo band → maintenance pillar +6.0.

Permissions Breakdown

• search medium Can manipulate search provider settings; medium risk on its own.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces new-tab page; monetization/search-redirect vector.

Pillar Scores

Bookkeeping