Top Risks

• NewTab override + search permission = classic ad-monetization shell; uninstall/install URL hijack to gameograf.com confirms monetization intent.
• Privacy policy URL timed out (fetched==false); treated as no policy — full 10.0 privacy score.
• No developer name listed; no verified publisher trust offset meaningful given monetization signals.
• Uninstall and install URL hijacks redirect to gameograf.com UTM-tracked pages — behavioural monetization confirmed.
• innerHTML DOM-XSS sink in popup.js with no CSP; exploitable if injected content reaches the sink.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html; replaces every new tab with extension-controlled page.
• uninstall_url_hijack crx setUninstallURL -> https://gameograf.com/?utm_source=gameograf&utm_medium=link&utm_campaign=bg&utm_content=uninstall
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install&utm_medium=link&utm_campaign=bg&utm_content=install
• privacy_policy_fetch_failed api Privacy policy URL fetch timed out (ReadTimeout); policy content unverifiable — scored as absent.
• no_developer_name store developer_name is empty string; accountability gap for operator of monetization-oriented extension.
• dom_xss_sink crx innerHTML assigned from variable in js/popup.js; no CSP present to mitigate DOM-XSS.
• host_permission_third_party manifest host_permissions includes https://api.gameograf.com/* — monetization/game portal backend.
• maintenance_stale store 14 months since last update; 6-12mo band (+3.5) exceeded into 12-24mo band (+6.0).

Permissions Breakdown

• search medium Allows manipulation of the browser search provider; paired with newtab override raises monetization risk.
• https://api.gameograf.com/* medium Scoped host permission to third-party game/monetization domain; data exfil surface.
• chrome_url_overrides.newtab medium Replaces new-tab page; classic monetization shell vector with search/ad injection potential.

Pillar Scores

Bookkeeping