Top Risks

• Privacy policy URL unreachable (fetch_error); no effective privacy disclosure for a NewTab extension replacing every new tab.
• Operator cluster of 9 compound-fingerprint siblings (33 by dev email) signals mass-production NewTab monetization shell.
• Both install and uninstall URL hijacks redirect to gameograf.com with UTM tracking — monetization-shell pattern.
• No CSP declared on MV3 extension with newtab override and innerHTML DOM-XSS sinks in popup.js and calendar.js.
• Verified publisher discount capped (v3.5/0c) due to monetization-cluster pattern; newtab override is HIGH capability.

Evidence

• operator_cluster_siblings api 9 compound siblings, 33 by dev_email; mass-produced NewTab shell cluster under support@gameograf.com.
• install_uninstall_url_hijack manifest Both onInstalled and onUninstall redirect to https://gameograf.com/?utm_source=extension&utm_medium=install.
• privacy_policy_fetch_error api Privacy policy URL https://api.gameograf.com/gameograf-privacy-policy.html returned ConnectionError; treated as no policy.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html replaces every new-tab page; core monetization surface.
• no_csp manifest content_security_policy is null; innerHTML sinks in popup.js and calendar.js lack mitigating CSP.
• dom_xss_sinks crx dom_sink_innerhtml_userctrl in js/popup.js and js/calendar.js; potential DOM-XSS if data from API is attacker-controlled.
• verified_publisher_cap_applied store v3.5 cap: verified publisher discount limited to -1.0 because extension contacts monetization cluster hosts.
• developer_name_missing store developer_name is empty string; no 'Offered by' display name on store listing.

Permissions Breakdown

• search medium Allows querying browser search engine; combined with newtab override raises monetization concern.
• host_permissions:https://api.gameograf.com/* low Scoped to dev's own domain; expected for a NewTab theme fetching assets/config.
• chrome_url_overrides:newtab medium Replaces every new-tab page; primary surface for monetization or search redirect.

Pillar Scores

Operator Siblings (15)

Other extensions sharing this developer's compound fingerprint:

• fdjpcjggpgdmdikmhoagohakklihimbo
• ammndifopdgpjcpmpbdenfcafipnejlj
• ojhigfemmjpjnmhidflhdlcahgdiiija
• ieocbmlfbinpcffofcjmpbjokkfghodc
• faaegcmakhlmoheamicddkfcmmjoljnd
• amfeinhgbpnnjihjiomibeodnainnjkd
• ceoamfmlgefiljnligpdkdindckojbim
• hlacaekdajdgiiofjplpofbgebgjbnco
• lcoeefcacppckhidgmkdlnbeajkmeick
• gfcbimjpmoeofbmnjedjfkemdinagkmp
• kmjgnidfglamdnllpoidpfikcodjapih
• heakmhbelclpalglpiceoocofnkcjefb
• gbeldgdcloiceglhpdnkhbafeoddjehm
• epjpkhahnajkdjjfkeadcgfmfjfgdohf
• fjmlhfejlohohljeioedcliggbfkihdf

Bookkeeping