Top Risks

• NewTab override replaces every new tab; combined with search permission enables full search monetization.
• Privacy policy is Google's generic policy — does not scope data collection to this extension at all.
• Uninstall and install URL hijack to gameograf.com tracking parameters; monetization shell pattern.
• External JS host bit.ly flagged as affiliate/cloaking redirector — actual destination opaque.
• months_since_update=15 with newtab override and no CSP elevates staleness risk.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab for all 751 users.
• uninstall_and_install_url_hijack crx Both onInstalled and onUninstall redirect to gameograf.com with UTM tracking params.
• affiliate_hit_bitly crx bit.ly listed in js_external_hosts; threat_intel flags as affiliate/cloaking short-link.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — not scoped to this extension.
• no_csp manifest content_security_policy is null; no CSP declared on MV3 extension.
• dom_xss_sink crx innerHTML assigned from variable in js/popup.js with no CSP mitigation.
• stale_newtab_no_csp store 15 months since update, newtab override, no CSP — elevated staleness+capability risk.
• verified_publisher_cap_applied store Verified publisher but months_since_update=15 >12 — v3.5(0c) caps discount to -1.0.

Permissions Breakdown

• search medium Allows altering search provider; newtab override compounds this risk.
• chrome_url_overrides.newtab high Replaces every new tab page; high reach over user browsing sessions.
• host_permissions: https://api.gameograf.com/* low Scoped to dev-controlled domain; limited blast radius.

Pillar Scores

Bookkeeping