Top Risks

• Privacy policy URL could not be fetched — no verifiable data handling disclosure for this extension.
• Operator cluster of 11 siblings under identical fingerprint signals a wallpaper/NewTab monetization factory.
• Uninstall and install URL hijacks confirmed — tracks user lifecycle events with UTM parameters to gameograf.com.
• NewTab override combined with 'search' permission enables search-query monetization across all new tabs.
• innerHTML DOM-XSS sink in popup.js without CSP protection; MV3 default CSP applies but no explicit policy set.

Evidence

• operator_cluster_siblings api 11 compound siblings under same dev-email/install-URL/uninstall-URL/CSP-host fingerprint — wallpaper factory pattern.
• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?utm_source=gameograf&utm_medium=link&utm_campaign=bg&utm_content=uninstall
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install&utm_medium=link&utm_campaign=bg&utm_content=install
• privacy_policy_fetch_error api Privacy policy URL returned HTTPError; classification defaulted to fetched=false → Privacy pillar +10.0.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; combined with search permission and sibling count = monetization shape.
• dom_xss_sink crx js/popup.js: innerHTML assignment from variable without sanitization; no explicit CSP to mitigate.
• maintenance_stale store 15 months since last update → Maintenance pillar +6.0 (6–12mo band boundary; 12–24mo = +6.0).
• no_developer_name store Developer name field is empty; only email info@gameograf.com provided; reputation penalty applied.

Permissions Breakdown

• search medium Allows reading/manipulating search queries; combined with newtab override raises monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; low blast radius.
• chrome_url_overrides.newtab medium Replaces new-tab page; high-frequency touchpoint enabling ad/search monetization.

Pillar Scores

Operator Siblings (13)

Other extensions sharing this developer's compound fingerprint:

• kenndofkbpgkfhaecjmnjmehhhbnioeh
• ieepfmpmjnjidennkopcbamjjdemhjcf
• chjbfnbpbgjnofhahgblpcifjcbkolcp
• bpicplogeibhabicoedobpchdkngbhjh
• jmokcnonladmkkdlgbalffkjiogfcgha
• aaobffjniaghknbgjdkigmcnapghemfa
• cfbobdhebljlbkhdhnikebhhijocphfo
• ckcailiifgopnblmaeaefimdgnaelcph
• dpkgeginpcjfcgnjicpkfkkbnpailidn
• hmagnnippelpfgkmbdnepolcgjlmbohh
• jimikjehahhdekhbmhpbmbponjcimajc
• iimgbphfdpnahafdmikdjnpfnffnbkcl
• gafbkkfalgndkoilabfhmjjjgeihboed

Bookkeeping