Top Risks

• NewTab override + install/uninstall URL hijack to gameograf.com — classic monetization shell pattern.
• Privacy policy is Google's own generic policy, not scoped to this extension; admits data collection and 3rd-party sharing.
• No developer name listed; reduces accountability.
• innerHTML DOM-XSS sink in popup.js with no CSP to mitigate.
• 16 months since last update on a NewTab search-override extension increases supply-chain risk.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to index.html — replaces every new tab.
• uninstall_url_hijack crx setUninstallURL targets https://gameograf.com/?utm_source=uninstall — 3rd-party tracking on removal.
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install — monetization redirect on install.
• generic_privacy_policy api Policy URL is Google's global privacy policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• no_developer_name store developer_name is empty string; reduced accountability.
• dom_xss_sink crx popup.js: innerHTML assigned from variable with no CSP — DOM-XSS risk.
• stale_extension store 16 months since last update on a NewTab monetization-pattern extension.
• external_host_mlionltd_github crx JS loads from mlionltd.github.io — third-party GitHub Pages host outside developer's primary domain.

Permissions Breakdown

• search medium Allows reading/modifying search queries; medium risk for NewTab/search-override pattern.
• host_permissions: https://api.gameograf.com/* low Scoped to own API domain only; limited reach.
• chrome_url_overrides.newtab medium Replaces new tab page — classic monetization/search-hijack surface.

Pillar Scores

Bookkeeping