Top Risks

• NewTab override combined with 'search' permission creates ad-monetization surface on every new tab.
• Uninstall and install URL hijack both redirect to gameograf.com tracking URLs.
• Stale 16-month-old extension with no CSP and innerHTML DOM-XSS sink in popup.js.
• External host mlionltd.github.io (GitHub Pages) is not under developer's direct control.
• New-tab wallpaper shell pattern: minimal functionality, monetization-shaped permission set.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to index.html — replaces every new-tab page.
• uninstall_url_hijack crx setUninstallURL targets https://gameograf.com/?utm_source=uninstall&utm_campaign=bg
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install&utm_campaign=bg
• external_host_third_party crx mlionltd.github.io referenced in JS — GitHub Pages host not controlled by developer.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• dom_xss_sink crx js/popup.js: innerHTML assigned from variable — DOM-XSS risk without CSP.
• stale_extension store 16 months since last update; verified publisher but no CSP and innerHTML sink present.
• verified_publisher store Verified publisher badge; developer domain resolves, no throwaway signals.

Permissions Breakdown

• search medium Allows reading/modifying search queries; combined with NewTab override raises monetization concern.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain only.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary monetization vector for wallpaper/NewTab shells.

Pillar Scores

Bookkeeping