Top Risks

• NewTab override with search permission enables search-traffic monetization on every new tab for 21 users.
• Uninstall and install URL hijack both redirect to gameograf.com — traffic harvesting pattern.
• Two innerHTML DOM-XSS sinks without CSP; no content_security_policy set (MV3 default applies but sinks remain).
• No developer name listed; identity accountability is low despite verified publisher badge.
• Privacy policy admits third-party sharing; extension contacts 12 external JS hosts including OpenAI and Google services.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — hijacks every new tab page.
• uninstall_url_hijack crx setUninstallURL targets https://gameograf.com/?utm_source=extension&utm_medium=install
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install
• dom_xss_sinks crx innerHTML assignments from variables in js/popup.js and js/calendar.js with no CSP guard.
• no_developer_name store developer_name field is empty; identity accountability reduced despite verified_publisher=true.
• search_permission_plus_newtab manifest search permission combined with newtab override is classic search-monetization cluster.
• js_external_hosts_breadth crx 12 external JS hosts including chat.openai.com, mail.google.com, slides.google.com, ssl.gstatic.com.
• privacy_policy_third_party_sharing api Policy fetched; scope_extension=true, data_collection=true, third_party_sharing=true, retention=true.

Permissions Breakdown

• search medium Allows querying browser search engine; combined with newtab override enables search monetization.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces every new tab — prime surface for search redirect and ad monetization.

Pillar Scores

Bookkeeping