Top Risks

• NewTab override replaces every new tab page — high-reach monetization surface with 'search' permission.
• Uninstall and install URL hijacking redirect users to gameograf.com — traffic harvesting pattern.
• Two unguarded innerHTML DOM-XSS sinks (popup.js, calendar.js) with no CSP to mitigate.
• No developer name listed; verified publisher but anonymous brand increases accountability gap.
• Extension contacts 12 external JS hosts including Google services; broad external surface for MV3.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html; replaces every new tab for all 19 users.
• uninstall_url_hijack crx setUninstallURL -> https://gameograf.com/?utm_source=extension&utm_medium=install
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install
• dom_xss_sinks crx innerHTML user-controlled in popup.js and calendar.js; no CSP on MV3 extension pages.
• no_csp manifest content_security_policy is null; MV3 default applies but extension pages lack hardened CSP.
• verified_publisher store Verified publisher badge present; gameograf.com resolves and is not throwaway.
• privacy_policy api Policy fetched; scope_extension=true, data_collection=true, retention=true, 3rd-party=true.
• search_permission_newtab manifest 'search' permission + newtab override + single search engine (google.com) — monetization shape.

Permissions Breakdown

• search medium Allows querying the search API; combined with newtab override raises monetization concern.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; not broad.
• chrome_url_overrides.newtab medium Replaces every new tab page; high-reach monetization surface typical of wallpaper shells.

Pillar Scores

Bookkeeping