Top Risks

• Privacy policy is Google's generic policy — does not scope data collection to this extension; admits data collection and 3rd-party sharing (Privacy +10.0).
• NewTab override replaces every new tab; uninstall and install URL hijack redirect users to developer site with UTM tracking.
• No CSP declared (MV3 default mitigates eval, but DOM-XSS sink in calendar.js with no policy raises exposure).
• No developer name listed despite verified publisher status; missing display identity increases accountability gap.
• Install and uninstall URL hijacking to gameograf.com with tracking parameters — classic NewTab monetization shell signal.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces all new-tab pages.
• uninstall_url_hijack crx setUninstallURL targets https://gameograf.com/?p=32854?utm_source=extension&utm_medium=uninstall.
• install_url_hijack crx onInstalled opens https://gameograf.com/?p=32854?utm_source=extension&utm_medium=install.
• generic_privacy_policy store Privacy policy URL points to myaccount.google.com/privacypolicy — Google's own policy, not extension-scoped.
• privacy_classification_admits_collection api Fetched policy: scope_extension=false, data_collection=true, third_party_sharing=true — generic policy admitting sharing.
• dom_xss_sink crx js/calendar.js: innerHTML assigned from variable — DOM-XSS sink with no CSP.
• no_developer_name store developer_name field is empty despite verified_publisher=true.
• new_tab_monetization_pattern store NewTab wallpaper shell with install/uninstall URL hijack + search permission = monetization fingerprint.

Permissions Breakdown

• search medium Can read and manipulate search queries; typical for NewTab/search-override extensions.
• alarms low Schedules periodic callbacks; low standalone risk.
• storage low Local data persistence; low risk on its own.
• chrome_url_overrides.newtab medium Replaces every new-tab page; high-reach surface, monetization vector.
• host_permissions: https://api.gameograf.com/* medium Scoped to developer's own API domain; single-domain outbound communication.

Pillar Scores

Bookkeeping