Top Risks

• Privacy policy is Google's own generic policy — does NOT cover this extension's data practices (scope_extension=false, data_collection=true, third_party_sharing=true).
• NewTab override + search permission = high-reach monetization surface on every new tab opened.
• Uninstall and install URL hijacks redirect to gameograf.com tracking URLs — telemetry at lifecycle events.
• No developer name listed; verified_publisher flag provides limited accountability for a fan-content shell.
• Stale 15 months (>12mo) with no CSP and innerHTML DOM sink in popup.js — latent XSS risk.

Evidence

• privacy_policy_generic store Policy URL is Google's account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (rule D).
• newtab_override manifest chrome_url_overrides.newtab set to index.html; replaces every new tab for all 1,000 users.
• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?utm_source=uninstall; +3.0 webstore signal.
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install; +2.0 webstore signal.
• no_developer_name store developer_name is empty string; +1.0 reputation penalty.
• dom_sink_innerhtml crx popup.js assigns user-controlled variable to innerHTML; no CSP present — DOM-XSS risk.
• maintenance_stale store 15 months since update → 6.0 maintenance pillar (12-24mo band).
• fan_content_shell store BLACKPINK fan wallpaper with newtab+search override and lifecycle hijacks = fan-content monetization shell pattern.

Permissions Breakdown

• search medium Allows querying/modifying search provider; combined with newtab override raises monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; low blast radius but enables data transmission.
• chrome_url_overrides.newtab medium Replaces every new tab — high reach, monetization vector, pairs with search override.

Pillar Scores

Bookkeeping