Top Risks

• NewTab override replaces every new tab — primary search monetization and redirect surface.
• Uninstall URL hijack + install URL hijack both point to gameograf.com with UTM tracking.
• No CSP defined (csp_present=false, MV3 default applied) — innerHTML sink in popup.js raises DOM-XSS risk.
• months_since_update=15 (6–18mo stale range) raises abandonment/supply-chain concern.
• mlionltd.github.io in js_external_hosts is an unverified third-party GitHub Pages host.

Evidence

• newtab_override manifest chrome_url_overrides.newtab=index.html — every new tab replaced; search monetization shape.
• uninstall_url_hijack crx setUninstallURL to https://gameograf.com/?utm_source=uninstall — tracking on removal.
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install — UTM tracking on install.
• no_csp manifest content_security_policy is null; MV3 strict default applies but no explicit CSP hardening.
• external_host_github_pages crx mlionltd.github.io in js_external_hosts — unverifiable third-party GitHub Pages domain.
• dom_xss_sink crx popup.js: popupContainer.innerHTML = html — unescaped variable in DOM sink.
• stale_extension store Last updated June 2025; months_since_update=15 — in 6–18mo stale band.
• verified_publisher store Verified publisher badge present; domain resolves; no throwaway signals — partial trust credit.

Permissions Breakdown

• search medium Allows search provider interaction; paired with NewTab override amplifies search monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to dev-controlled API domain only; narrow and expected for NewTab data fetch.
• chrome_url_overrides.newtab medium Replaces every new tab; primary surface for monetization and search redirect.

Pillar Scores

Bookkeeping