Top Risks

• NewTab override replaces every new tab with developer-controlled content enabling search/ad monetization.
• Privacy policy is Google's generic policy (scope_extension=false, data_collection=true, third_party_sharing=true) — not scoped to this extension.
• Uninstall and install URL hijacks redirect users to gameograf.com with UTM tracking parameters.
• Two innerHTML DOM-XSS sinks in calendar.js and popup.js with no CSP to mitigate injection.
• Extension is 13 months stale (6–24mo band) with newtab monetization shape still active.

Evidence

• newtab_override manifest chrome_url_overrides.newtab=newtab.html; search permission present — classic monetization NewTab pattern.
• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?utm_source=gameograf&utm_medium=link&utm_campaign=bg&utm_content=uninstall
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install&utm_medium=link&utm_campaign=bg&utm_content=install
• generic_privacy_policy store PP URL is Google's own account policy (myaccount.google.com); scope_extension=false, data_collection=true, third_party_sharing=true.
• dom_xss_sink crx innerHTML sinks in js/calendar.js and js/popup.js; csp_present=false increases exploitation risk.
• no_developer_name store developer_name is empty string; reduces accountability signal.
• stale_extension store 13 months since update — falls in 6–24mo band (+6.0 maintenance).
• verified_publisher store verified_publisher=true for gameograf.com (resolves, age 2051 days); partial reputation discount applied.

Permissions Breakdown

• search medium Allows search provider manipulation; paired with newtab override amplifies monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces new-tab page — primary surface for ad/monetization injection.

Pillar Scores

Bookkeeping