Top Risks

• NewTab override with uninstall+install URL hijack to gameograf.com — monetization shell pattern.
• Uninstall and install URL hijacks both fire on lifecycle events, exfiltrating UTM-tagged signals.
• No CSP on MV3 extension with innerHTML sinks in popup.js and calendar.js — DOM-XSS exposure.
• No developer name listed despite verified publisher status; opacity around operator identity.
• 120 installs with no ratings; minimal community validation for a newtab page replacing user browsing.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html; hijacks new-tab page for every browse session.
• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?utm_source=extension&utm_medium=install
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install
• csp_absent manifest content_security_policy is null; MV3 default CSP applies but no extension-level hardening.
• dom_xss_sink crx innerHTML assigned from variable in popup.js and calendar.js — two DOM-XSS sinks found.
• no_developer_name store developer_name is empty string; verified publisher but operator identity not surfaced.
• verified_publisher store Verified publisher badge present; reduces reputation risk but doesn't negate monetization signals.
• privacy_policy_adequate api Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true.

Permissions Breakdown

• search medium Allows reading/querying search data; paired with newtab override raises monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to dev-controlled domain only; limits outbound reach.
• chrome_url_overrides.newtab medium Replaces new-tab page; classic monetization/search-redirect surface.

Pillar Scores

Bookkeeping