Top Risks

• Fortnite brand impersonation by unconfirmed owner (gameograf.com ≠ Epic Games)
• Privacy policy URL on unrelated domain (haberikra.com) failed to fetch — scored as no policy
• Uninstall and install URL hijacking redirect users to gameograf.com with tracking params
• NewTab override + search permission = ad/search monetization surface with no transparency
• No developer name listed; privacy policy inaccessible; no ratings/reviews for trust signals

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; Fortnite mentioned, developer gameograf.com is not Epic Games.
• privacy_policy_fetch_failed api privacy_policy_classification.fetched=false; fetch_error:ReadTimeout on haberikra.com — treated as no policy.
• uninstall_url_hijack crx uninstall_url_hijack=true; redirects to gameograf.com with UTM tracking params on uninstall.
• install_url_hijack crx install_url_hijack=true; opens gameograf.com with UTM params on install — monetization pattern.
• newtab_override_with_search manifest chrome_url_overrides.newtab present + search permission; classic ad-monetization NewTab shell.
• no_developer_name store developer_name is empty string; reduces accountability and identity verification.
• privacy_policy_domain_mismatch store Privacy policy URL is haberikra.com, not gameograf.com — unrelated domain, further eroding trust.
• dom_xss_sink crx innerHTML written from variable in js/popup.js; no CSP present to mitigate DOM-XSS risk.

Permissions Breakdown

• search medium Allows querying/modifying search behavior; paired with newtab override raises monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to own API domain; low risk in isolation.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary vector for ad/search monetization in this category.

Pillar Scores

Bookkeeping