Top Risks

• NewTab override monetization pattern: uninstall+install URL hijack to gameograf.com with UTM tracking.
• No CSP (csp_present=false) + innerHTML sinks in popup.js and calendar.js expose DOM-XSS surface.
• No developer name listed; verified publisher status partially mitigates but identity accountability is weak.
• NewTab replaces every new tab for life of install — high-reach despite only 14 installs currently.
• Privacy policy fetched and scoped, but extension contacts 12 external JS hosts including major Google services.

Evidence

• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?utm_source=extension&utm_medium=install (3rd-party redirect).
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html — full new-tab replacement.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension with innerHTML sinks.
• dom_xss_sinks crx innerHTML user-controlled in js/popup.js and js/calendar.js; no CSP or eval, score +2.0.
• verified_publisher store gameograf.com resolves, not throwaway; verified publisher badge; domain not new.
• privacy_policy_adequate api Policy fetched, scoped to extension, data_collection+retention+third_party_sharing all true.
• no_developer_name store developer_name is empty string; no display name in store listing.

Permissions Breakdown

• search medium Allows querying and potentially overriding search defaults; elevated in NewTab context.
• host_permissions: https://api.gameograf.com/* low Scoped to dev-owned domain only; used for wallpaper/API calls.
• chrome_url_overrides.newtab medium Replaces new tab page — high-reach surface for monetization and data collection.

Pillar Scores

Bookkeeping