Top Risks

• NewTab override with uninstall and install URL hijack to gameograf.com — classic traffic-monetization shell pattern.
• Two innerHTML DOM-XSS sinks with no CSP; no mitigating policy to block exploitation.
• Verified publisher but no developer name listed; minor accountability gap.
• Maintenance borderline at 12 months (6-12mo stale band) with 2000 installs.
• Privacy policy discloses third-party sharing; data collection confirmed but scoped.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL to https://gameograf.com/?utm_source=gameograf... — Webstore +3.0.
• install_url_hijack manifest onInstalled opens https://gameograf.com/?utm_source=install... — Webstore +2.0.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html — NewTab with monetization shape, Webstore +2.0.
• csp_absent crx content_security_policy is null; MV3 has strict default but no explicit CSP declared.
• dom_xss_sinks crx innerHTML assignments in popup.js and calendar.js; csp_present==false triggers +2.0 code quality (FIX B).
• verified_publisher store Verified publisher badge present; -3.0 reputation (floored at 2.0 per hard floor rule).
• privacy_policy_classification api Fetched, scoped, data_collection=true, retention=true, third_party_sharing=true → +1.0 privacy pillar.
• maintenance_stale store months_since_update=12 falls in 6-12mo band → +3.5 maintenance.

Permissions Breakdown

• search medium Allows querying the browser's search engine; relevant to NewTab but grants search API access.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; no broad host access.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary vector for NewTab monetization and search-redirect patterns.

Pillar Scores

Bookkeeping