Top Risks

• NewTab override replaces every new tab; combined with 'search' permission enables search monetization without user consent.
• Uninstall and install URL hijack both redirect to gameograf.com tracking URL — confirmed monetization shell pattern.
• Two innerHTML sinks without CSP (csp_present=false) expose DOM-XSS risk on NewTab and popup pages.
• No developer name listed; anonymous publisher reduces accountability despite verified publisher status.
• Extension contacts 12 external JS hosts including Google services and its own API without explicit user-facing justification.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — every new tab captured.
• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?utm_source=extension&utm_medium=install (3rd-party tracking).
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install.
• dom_xss_sinks crx innerHTML user-controlled in js/popup.js and js/calendar.js with no CSP present.
• no_csp manifest content_security_policy is null; MV3 default is partial protection but no explicit script-src hardening.
• search_permission_newtab_combo manifest 'search' permission + newtab override is canonical ad-monetization pattern.
• verified_publisher store verified_publisher=true; discount applied but no developer_name listed, limiting accountability.
• js_external_hosts crx 12 external hosts contacted including api.gameograf.com and multiple Google service domains.

Permissions Breakdown

• search medium Allows querying the default search engine; combined with newtab override creates search monetization surface.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain only; acceptable for wallpaper config fetch.
• chrome_url_overrides.newtab medium NewTab override captures every new-tab event; primary monetization vector for this extension type.

Pillar Scores

Bookkeeping