Top Risks

• NewTab override + uninstall/install URL hijack to gameograf.com — classic traffic-monetization shell pattern.
• No developer name listed; no install count; brand-thin presence raises accountability concerns.
• DOM-XSS innerHTML sinks in popup.js and calendar.js with no CSP to mitigate exploitation.
• Extension contacts 12 external JS hosts including Google services — broad network footprint beyond stated function.
• Verified publisher discount applied but no install data; verified badge limits but doesn't eliminate risk.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL points to https://gameograf.com/?utm_source=extension&utm_medium=install — 3rd-party redirect.
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install — install-time redirect.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html — every new tab replaced by extension.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening for DOM sinks.
• dom_sink_innerhtml crx innerHTML assignments in js/popup.js and js/calendar.js — DOM-XSS sinks with no CSP.
• broad_js_hosts crx 12 external JS hosts including mail.google.com, chat.openai.com, drive.google.com beyond core function.
• verified_publisher store Verified publisher badge present; developer domain resolves; not throwaway.
• no_developer_name store developer_name is empty string — no displayed 'Offered by' entity beyond email.

Permissions Breakdown

• search medium Allows reading/manipulating search queries; typical for NewTab but grants search override capability.
• chrome_url_overrides.newtab medium Replaces every new tab — high reach, monetization surface, ad-tech injection risk.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain only.

Pillar Scores

Bookkeeping