Top Risks

• NewTab override replaces every new-tab page — persistent monetization/tracking surface on 580 installs.
• Uninstall URL hijack sends user to gameograf.com on removal — behavioral monetization signal.
• Install URL hijack opens gameograf.com on first install — onboarding tracking.
• No developer name listed; verified publisher but empty 'Offered by' field reduces accountability.
• innerHTML DOM-XSS sink in calendar.js without CSP; low exploitability but code hygiene concern.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — controls every new-tab page.
• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?p=33110?utm_source=extension&utm_medium=uninstall
• install_url_hijack crx onInstalled opens https://gameograf.com/?p=33110?utm_source=extension&utm_medium=install
• verified_publisher store gameograf.com is a verified publisher; domain resolves, not throwaway.
• privacy_policy_adequate api Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true.
• dom_xss_sink crx innerHTML assigned from variable in js/calendar.js; no CSP present on MV3 extension.
• no_developer_name store developer_name field is empty string; reduces accountability despite verified publisher.
• search_engine_count_ok api Only 1 search engine (google.com) seen; no multi-engine ad-aggregator pattern.

Permissions Breakdown

• search medium Allows querying the browser search engine; relevant for NewTab but can intercept search intent.
• alarms low Scheduling only; low standalone risk.
• storage low Local data persistence; minimal risk.
• chrome_url_overrides.newtab medium Replaces every new-tab page; persistent high-reach surface for monetization or tracking.
• host_permissions: https://api.gameograf.com/* low Scoped to own API domain; not broad.

Pillar Scores

Bookkeeping