Top Risks

• NewTab override with search permission — classic ad/search monetization shell pattern.
• Privacy policy URL on unrelated domain (haberikra.com) and fetch failed — no effective policy.
• Uninstall and install URL hijacks both present — traffic harvesting on lifecycle events.
• No CSP on MV3 extension with DOM-XSS sink (innerHTML) in popup.js.
• 15-month stale update; verified-publisher discount capped at -1.0 per v3.5 invariant 0c (months_since_update > 18 not met, but privacy_policy fetch failed).

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces new tab page.
• uninstall_url_hijack crx setUninstallURL to https://gameograf.com/?utm_source=gameograf&utm_campaign=bg&utm_content=uninstall
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install&utm_campaign=bg&utm_content=install
• privacy_policy_fetch_failed api Privacy policy at haberikra.com (unrelated domain) returned HTTPError — treated as unfetched.
• no_csp manifest content_security_policy is null; innerHTML sink in popup.js has no CSP mitigation.
• search_permission_newtab_combo manifest search permission + newtab override = monetization shell fingerprint.
• developer_name_missing store developer_name is empty string; no 'Offered by' display name.
• maintenance_stale store Last updated June 2025 — 15 months ago, falling in 12-24mo band (+6.0).

Permissions Breakdown

• search medium Allows manipulation of search provider; combined with newtab override raises monetization concern.
• chrome_url_overrides.newtab high Replaces new tab page — primary surface for search/ad monetization shells.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.

Pillar Scores

Bookkeeping