Top Risks

• Privacy policy is Google's generic policy (not extension-scoped), admitting data collection and 3rd-party sharing — score +10 on privacy pillar.
• Uninstall and install URL hijacks redirect to developer domain, a monetization shell fingerprint.
• New-tab override with affiliate/cloaking link (bit.ly) in external JS hosts signals traffic monetization.
• Stale 16 months with no CSP and newtab override; capability gate applies to verified-publisher discount.
• DOM XSS sink (innerHTML from variable) in popup.js with no CSP to mitigate.

Evidence

• uninstall_url_hijack manifest setUninstallURL targets gameograf.com with UTM params — monetization shell fingerprint (+3.0 webstore).
• install_url_hijack manifest onInstalled opens gameograf.com with UTM params — install URL hijack (+2.0 webstore).
• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (v3.5 D).
• affiliate_hit crx bit.ly in js_external_hosts flagged as affiliate/cloaking redirector (+1.5 webstore v3.5 A).
• newtab_override manifest chrome_url_overrides.newtab replaces new-tab page; +2.0 webstore for newtab override with monetization shape.
• dom_sink_innerhtml_userctrl crx innerHTML from variable in popup.js, no CSP present — DOM-XSS risk elevated to +2.0 per FIX B.
• stale_extension store 16 months since update; +6.0 maintenance (12-24mo band). Caps verified-publisher discount via invariant 0c (stale >18mo not reached but >12mo is significant).
• no_csp manifest content_security_policy is null (MV3 default strict applies, no explicit CSP override declared).

Permissions Breakdown

• search medium Allows reading and potentially overriding search engine; medium risk for NewTab category.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; low breadth.
• chrome_url_overrides.newtab medium Replaces new-tab page; monetization vector, persistent reach on every new tab.

Pillar Scores

Bookkeeping