Top Risks

• NewTab override on every new tab — high-reach monetization/redirect surface for 277 users.
• Uninstall URL hijack to gameograf.com UTM-tracked page signals traffic monetization intent.
• Install URL hijack on extension install opens 3rd-party page — unwanted install-time navigation.
• No CSP present (MV3) combined with innerHTML DOM-XSS sink in calendar.js.
• No developer name listed despite verified publisher; search permission paired with NewTab increases ad-pivot risk.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html — replaces every new tab; primary monetization vector.
• uninstall_url_hijack manifest setUninstallURL → https://gameograf.com/?p=33143?utm_source=extension&utm_medium=uninstall
• install_url_hijack manifest onInstalled opens https://gameograf.com/?p=33143?utm_source=extension&utm_medium=install
• dom_xss_sink crx js/calendar.js: innerHTML assigned from variable without sanitization — DOM-XSS risk.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• verified_publisher store support@gameograf.com is a verified publisher; domain resolves and is not throwaway.
• privacy_policy store Policy fetched, scoped to extension, covers collection/retention/3rd-party sharing — adequate.
• search_permission_newtab manifest 'search' permission + NewTab override is a known search-monetization cluster pattern.

Permissions Breakdown

• search medium Can read/manipulate search queries; paired with NewTab override raises monetization concern.
• alarms low Schedules background tasks; low standalone risk.
• storage low Local data persistence; standard low-risk permission.
• chrome_url_overrides.newtab high Replaces every new tab; high-reach monetization/redirect surface.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; not broad.

Pillar Scores

Bookkeeping