Top Risks

• Privacy policy URL is on a different domain (haberikra.com) and fetch failed — effectively no accessible policy.
• Fortnite brand impersonation: developer (gameograf.com) is not confirmed owner of Fortnite IP.
• Uninstall URL hijack redirects to gameograf.com with UTM tracking; install hijack also present.
• New-tab override combined with 'search' permission is classic ad-monetization shell pattern.
• No developer name listed; mismatched privacy policy domain raises accountability concerns.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'fortnite'; confirmed_owner=false; dev domain is gameograf.com.
• privacy_policy_fetch_failure api privacy_policy_classification.fetched=false (HTTPError); policy on unrelated domain haberikra.com.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() targets gameograf.com with UTM params.
• install_url_hijack crx onInstalled opens gameograf.com with UTM install tracking params.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; standard monetization shell vector.
• no_developer_name store developer_name is empty string; reduces accountability.
• dom_xss_sink crx js/popup.js: innerHTML assigned from variable with no CSP; DOM-XSS risk.
• months_since_update_15 store Last updated June 2025; 15 months since update — in 6-12mo stale band.

Permissions Breakdown

• search medium Allows querying browser search; medium risk in context of NewTab override.
• host:https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces new-tab page; central monetization vector for wallpaper/shell extensions.

Pillar Scores

Bookkeeping