Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Retro donkey kong gaming room [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall and install URL hijack both redirect to gameograf.com UTM-tracked page — classic traffic-monetization shell pattern.
• NewTab override replaces every new tab with developer-controlled page; combined with 'search' permission enables search monetization.
• Two DOM-XSS innerHTML sinks with no CSP present — elevated XSS risk if API data is attacker-influenced.
• Developer name (Dekuy.com) differs from email domain (gameograf.com) — split identity raises accountability concern.

Evidence

• uninstall_url_hijack manifest setUninstallURL → https://gameograf.com/?utm_source=dekuy&utm_medium=dekuy (3rd-party UTM redirect).
• install_url_hijack manifest onInstalled opens https://gameograf.com/?utm_source=dekuy&utm_medium=dekuy.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; replaces every new tab.
• dom_xss_sinks crx innerHTML user-controlled in popup.js and calendar.js; no CSP to mitigate.
• no_csp manifest content_security_policy is null; MV3 default is strict but inline sinks remain exploitable.
• dev_identity_mismatch store Developer listed as Dekuy.com but email domain is gameograf.com; split branding.
• privacy_policy_scope api Policy fetched; scope_extension=true, data_collection=true, third_party_sharing=true, retention=true.
• search_engine_count api Only google.com seen; single search engine, no multi-engine monetization aggregation detected.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Retro donkey kong gaming room [adware] + malext.io malicious_extension_sentry; score 4.21 -> 6.71 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/manipulating search queries; paired with newtab override raises monetization concern.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain only.
• chrome_url_overrides.newtab medium Replaces every new tab; high-reach surface for ad injection or search hijack.

Pillar Scores

Bookkeeping