Top Risks

• NewTab override + uninstall/install URL hijack: classic traffic-monetization shell pattern from operator cluster of 11+ siblings.
• Privacy policy is Google's generic account policy — not scoped to this extension; data_collection+third_party_sharing admitted without extension-specific disclosure.
• Verified publisher discount capped at -1.0: extension is 15mo stale (>12mo threshold triggers v3.5 invariant 0c).
• Large operator cluster (11 compound siblings, 28 by dev email) signals factory-produced wallpaper/newtab monetization operation.
• dom_sink_innerhtml_userctrl in popup.js with no CSP present raises DOM-XSS exposure.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html; primary monetization surface for this extension class.
• uninstall_url_hijack crx setUninstallURL -> gameograf.com with UTM params; Webstore +3.0 penalty applied.
• install_url_hijack crx onInstalled opens gameograf.com with UTM params; Webstore +2.0 penalty applied.
• operator_cluster api 11 compound siblings, 28 by dev email; large factory-wallpaper operator cluster.
• privacy_policy_generic store URL is myaccount.google.com/privacypolicy — Google's own policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• no_csp manifest content_security_policy is null/absent on MV3 extension; amplifies DOM-XSS risk from innerHTML sink.
• dom_sink_innerhtml crx popup.js assigns innerHTML from variable with no CSP guard; DOM-XSS sink confirmed by code_findings_raw.
• stale_extension store 15 months since update; verified-publisher discount capped at -1.0 per invariant 0c (>12mo stale).

Permissions Breakdown

• search medium Allows reading/manipulating search queries; paired with newtab override raises monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to own API domain only; limited blast radius.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary monetization vector for this class of extension.

Pillar Scores

Operator Siblings (13)

Other extensions sharing this developer's compound fingerprint:

• kenndofkbpgkfhaecjmnjmehhhbnioeh
• ieepfmpmjnjidennkopcbamjjdemhjcf
• chjbfnbpbgjnofhahgblpcifjcbkolcp
• bpicplogeibhabicoedobpchdkngbhjh
• jmokcnonladmkkdlgbalffkjiogfcgha
• aaobffjniaghknbgjdkigmcnapghemfa
• cfbobdhebljlbkhdhnikebhhijocphfo
• ckcailiifgopnblmaeaefimdgnaelcph
• dpkgeginpcjfcgnjicpkfkkbnpailidn
• hmagnnippelpfgkmbdnepolcgjlmbohh
• jofgjibhmlaeofgmidllemkckkpgnpbd
• iimgbphfdpnahafdmikdjnpfnffnbkcl
• gafbkkfalgndkoilabfhmjjjgeihboed

Bookkeeping