Top Risks

• NewTab override replaces every new-tab for all users — high-reach monetization surface.
• Uninstall and install URL hijacks fire tracking pixels to gameograf.com on lifecycle events.
• Two innerHTML DOM-XSS sinks with no CSP to mitigate exploitation if API response is poisoned.
• No developer name listed; search permission combined with newtab override expands control.
• MV3 but no content_security_policy declared, leaving innerHTML sinks without CSP protection.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces every new tab for installed users.
• uninstall_url_hijack manifest setUninstallURL targets https://gameograf.com/?utm_source=gameograf&utm_medium=link&utm_campaign=bg&utm_content=uninstall
• install_url_hijack manifest onInstalled opens https://gameograf.com/?utm_source=install&utm_medium=link&utm_campaign=bg&utm_content=install
• dom_sink_innerhtml_userctrl crx innerHTML sinks in popup.js and calendar.js; no CSP present to mitigate DOM-XSS risk.
• no_csp manifest content_security_policy is null; MV3 default applies but innerHTML sinks remain unmitigated.
• verified_publisher store gameograf.com verified publisher; domain resolves, not throwaway — partially offsets reputation risk.
• privacy_policy_adequate api Policy fetched, scoped to extension, data collection, retention and third-party sharing all disclosed.
• low_install_newtab store Only 724 installs for a NewTab extension; small blast radius but uninstall/install hijacks present.

Permissions Breakdown

• search medium Can manipulate search provider behavior; medium risk for a NewTab extension.
• host_permissions: https://api.gameograf.com/* low Scoped to developer-controlled API domain only.
• chrome_url_overrides.newtab medium Replaces the new-tab page; high-reach surface for monetization or data collection.

Pillar Scores

Bookkeeping