Top Risks

• Privacy policy URL returns fetch error — effectively no accessible policy for a 27-month-stale extension.
• Uninstall URL hijack redirects users to third-party game portal (play.gameograf.com/best-games).
• Extension is 27 months since last update — well into zombie territory with no changelog.
• No developer name listed in store; identity accountability is limited to email only.
• Install URL hijack opens index.html on install, pattern consistent with monetization shells.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL points to https://www.play.gameograf.com/best-games (3rd-party game portal).
• install_url_hijack crx onInstalled opens index.html — low-risk local target but confirms hijack pattern.
• privacy_policy_fetch_error api privacy_policy_classification.fetched==false; ConnectionError on https://www.play.gameograf.com/privacy.
• maintenance_stale store Last updated June 2024; 27 months since update — exceeds 24-month zombie threshold.
• no_developer_name store developer_name is empty string; no 'Offered by' identity beyond email info@gameograf.com.
• verified_publisher store verified_publisher==true; provides modest reputation credit, partially offset by staleness.
• no_csp manifest content_security_policy is null / csp_present==false; MV3 strict default applies, no penalty.
• low_installs store Only 38 installs; blast radius minimal but install_perm_anomaly flags not triggered.

Permissions Breakdown

• activeTab low Grants access to current tab only on user interaction; minimal standalone risk.

Pillar Scores

Bookkeeping