Top Risks

• NewTab override replaces every new-tab page — persistent monetization surface.
• Install and uninstall URL hijack both fire to gameograf.com with UTM tracking parameters.
• Two innerHTML DOM-XSS sinks (popup.js, calendar.js) with no CSP to mitigate.
• No developer name listed despite verified publisher status; reduced accountability.
• search permission + newtab override enables search-behavior tracking on every browser session.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html — replaces every new-tab page.
• install_url_hijack manifest onInstalled fires to https://gameograf.com/?utm_source=install — install hijack.
• uninstall_url_hijack manifest setUninstallURL fires to https://gameograf.com/?utm_source=gameograf — uninstall hijack.
• dom_xss_sink crx innerHTML assigned from variable in popup.js and calendar.js; no CSP to block exploitation.
• no_csp manifest content_security_policy is null on MV3 extension; DOM sinks have no mitigating CSP.
• verified_publisher store verified_publisher=true; gameograf.com resolves and is not throwaway — lowers reputation risk.
• privacy_policy api Policy fetched, scoped to extension, discloses data collection, retention, and third-party sharing.
• maintenance store Last updated September 2025, 11 months ago — 3-6 month band: +1.5.

Permissions Breakdown

• search medium Allows reading/modifying search queries; medium risk for a NewTab extension.
• host: https://api.gameograf.com/* low Scoped to developer's own API domain only.
• chrome_url_overrides.newtab medium Replaces new-tab page — core monetization surface for this category.

Pillar Scores

Bookkeeping