Top Risks

• NewTab override replaces every new-tab page; prime monetization and redirect surface.
• Uninstall and install URL hijack both point to gameograf.com tracking URLs.
• No developer name listed; identity accountability gap.
• NewTab + search permission combo with no CSP; DOM-XSS sink in calendar.js.
• No sibling cluster but install/uninstall URL hijack pattern typical of traffic-monetization shells.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces every new-tab page.
• uninstall_url_hijack manifest setUninstallURL to https://gameograf.com/?p=32932?utm_source=extension&utm_medium=uninstall
• install_url_hijack manifest onInstalled opens https://gameograf.com/?p=32932?utm_source=extension&utm_medium=install
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• dom_xss_sink crx js/calendar.js assigns innerHTML from variable — DOM-XSS risk without CSP.
• no_developer_name store developer_name is empty string; reduced accountability.
• privacy_policy_adequate api Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true.
• domain_age api gameograf.com first cert 2021-02-03, age 2051 days, 265 certs — established domain.

Permissions Breakdown

• search medium Allows reading and potentially influencing search provider behavior.
• alarms low Scheduling only; no data access.
• storage low Local/sync storage; limited scope.
• chrome_url_overrides.newtab medium Replaces new-tab page; high user-interaction surface and monetization vector.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; not broad.

Pillar Scores

Bookkeeping