Top Risks

• NewTab override replaces every new tab; combined with uninstall/install URL hijack indicating monetization intent.
• Uninstall and install URL hijacking both present — classic traffic-monetization shell pattern.
• No developer name listed; verified publisher but no 'Offered by' identity increases accountability gap.
• DOM-XSS sink (innerHTML) in calendar.js without CSP on MV3; exploitable if data sources are attacker-controlled.
• Privacy policy admits third-party data sharing; extension contacts 12 external hosts including Google services.

Evidence

• uninstall_url_hijack manifest setUninstallURL to gameograf.com with UTM params — monetization shell indicator (+3.0 webstore).
• install_url_hijack manifest onInstalled opens gameograf.com with UTM params — install URL hijack pattern (+2.0 webstore).
• newtab_override manifest chrome_url_overrides.newtab intercepts every new tab; combined with search perm = monetization surface.
• verified_publisher store Verified publisher on gameograf.com; domain resolves, not throwaway. Reputation discount applied.
• no_developer_name store developer_name is empty string; +1.0 reputation penalty for missing 'Offered by' identity.
• dom_sink_innerhtml crx innerHTML sink in calendar.js with no CSP present; DOM-XSS risk if calendar data is attacker-influenced.
• privacy_policy_classification api Policy scoped, collects data, discloses retention and third-party sharing; adequate — pillar 0.0.
• js_external_hosts crx 12 external hosts referenced including Google services and own API; country_count=2, no geo-diversity penalty.

Permissions Breakdown

• search medium Allows reading/modifying search engine; NewTab+search is monetization surface.
• alarms low Schedules periodic tasks; low standalone risk.
• storage low Local data persistence; low risk.
• chrome_url_overrides.newtab medium Replaces new tab page; high-frequency intercept of every new tab.
• host_permissions: https://api.gameograf.com/* low Scoped to own API domain only; limited blast radius.

Pillar Scores

Bookkeeping