Top Risks

• Privacy policy URL returns fetch error — treated as no policy; full +10.0 privacy score.
• Uninstall and install URL hijacks redirect users to 3rd-party gameograf.com tracking URLs.
• NewTab override with 'search' permission across 17-sibling dev-email cluster = monetization shell pattern.
• operator_cluster sibling_count=2 (compound) and 17 under same dev email indicate mass-production NewTab factory.
• No CSP + innerHTML user-controlled sink in popup.js raises DOM-XSS risk.

Evidence

• privacy_policy_fetch_failed api privacy_policy_classification.fetched=false (HTTPError); scored as no policy → +10.0 Privacy.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com UTM tracking link; +3.0 Webstore.
• install_url_hijack crx onInstalled opens gameograf.com UTM tracking link; +2.0 Webstore.
• operator_cluster api 17 siblings under same dev email, 2 compound siblings; +2.5 Webstore.
• newtab_override manifest chrome_url_overrides.newtab set; NewTab+search = monetization shape +2.0 Webstore.
• dom_sink_innerhtml_userctrl crx js/popup.js innerHTML from variable; no CSP present → scored +2.0 Code Quality (FIX B).
• no_csp manifest content_security_policy null; MV3 so no +2.0 network penalty, but amplifies code findings.
• stale_16mo store months_since_update=16 → +6.0 Maintenance (6-12mo bracket crossed; 16mo maps to 6-12 bracket: +3.5, but 12-24 → +6.0).

Permissions Breakdown

• search medium Allows querying the browser search API; paired with NewTab override, enables search monetization.
• host_permissions: https://api.gameograf.com/* low Scoped to developer-owned API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces every new tab page; high reach, monetization surface.

Pillar Scores

Operator Siblings (6)

Other extensions sharing this developer's compound fingerprint:

• pikefoaagadfjcgbhgdhdboefoohdpbe
• onjaegfaigiefjodacjpeigblaifalab
• daaiminpbfdcmdacaomdnemceoillghm
• bdgjlkghndpkfhfhpdgeabcfnkjanagl
• gillmlaalielgmhgekhkolcbcjghaeki
• ediemaoaclggogobngcpcfdanoakkpga

Bookkeeping