Top Risks

• Uninstall and install URL hijack both redirect to gameograf.com — classic traffic monetization shell pattern.
• Privacy policy is Google's generic account policy; does not scope to this extension, yet admits data collection and third-party sharing (+10 privacy).
• NewTab override + search permission with gameograf.com monetization domain in JS hosts indicates ad-traffic monetization.
• No developer name listed; manifest name/description use i18n placeholders — low transparency.
• Extension is 16 months stale with verified-publisher discount capped at -1.0 per invariant 0c (stale >18 mo threshold close; monetization hits tip cap).

Evidence

• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install — 3rd-party monetization domain.
• uninstall_url_hijack crx setUninstallURL targets https://gameograf.com/?utm_source=gameograf — +3.0 webstore penalty.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; search permission present — monetization shape.
• generic_privacy_policy store Policy URL is Google's account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10 privacy.
• js_external_hosts_monetization crx gameograf.com in js_external_hosts alongside 8 major platforms; monetization domain confirmed.
• no_developer_name store developer_name is empty string; manifest name uses i18n placeholder — low accountability.
• verified_publisher store Verified publisher badge present; discount capped at -1.0 due to monetization hits (v3.5 invariant 0c/E).
• maintenance_stale store 16 months since update → maintenance score 6.0 (6-12mo band boundary).

Permissions Breakdown

• search medium Can override search provider; paired with newtab override amplifies monetization risk.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary surface for ad-monetization and traffic hijacking.

Pillar Scores

Bookkeeping