Top Risks

• NewTab override with large operator cluster (8 compound siblings, 35 by dev email) — classic wallpaper/monetization shell farm.
• Privacy policy URL returned HTTP error; policy effectively unavailable — privacy pillar scores maximum.
• Install and uninstall URL hijacks redirect to gameograf.com with UTM tracking on every install/removal.
• operator_cluster.sibling_count >= 1 confirms coordinated multi-extension publishing pattern.
• DOM-XSS sinks (innerHTML) in popup.js and calendar.js without CSP to mitigate.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html; captures all new-tab events.
• uninstall_url_hijack crx setUninstallURL -> https://gameograf.com/?utm_source=gameograf&utm_medium=link&utm_campaign=bg&utm_content=uninstall
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install&utm_medium=link&utm_campaign=bg&utm_content=install
• operator_cluster api sibling_count=8 compound; 35 extensions share dev email support@gameograf.com.
• privacy_policy_fetch_error api Privacy policy URL https://gameograf.com/privacy-policy/ returned HTTPError; treated as unfetched.
• dom_xss_sinks crx innerHTML from variable in popup.js and calendar.js; no CSP to constrain execution.
• no_developer_name store developer_name field is empty string; accountability gap.
• verified_publisher store Verified publisher badge present; applied discount capped per v3.5 invariant 0c (monetization install/uninstall hooks).

Permissions Breakdown

• search medium Allows reading/manipulating search queries; medium risk on its own.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides.newtab medium NewTab override captures every new-tab open; monetization surface.

Pillar Scores

Operator Siblings (15)

Other extensions sharing this developer's compound fingerprint:

• kbbpgbdclanolnidddbeolaaddllgebp
• kgdahhodabbdnkkphjpneoiadhdphhna
• dihbfoicmibapnfojehonedckdjhegbe
• gfgopigkkjcinmgoancipefafljdfghd
• cdmooeifaodbcailnibfpnmbighehpkj
• pjbnoadhjobchdjkfhpehlbigakbjfii
• iobnmhnecelingbpdadgpmalbdagjbnb
• jpmpdfcaaelghoomjgdebmoekdfkhabp
• cifonlmfhnimmghojdepepjdgbbminel
• dbomdodikcfpocimcpegpbnlmankljcb
• dmdfahkplmikmlboodadelolcmbjgmff
• ckodcbbdgmpjidpfcipfobfagemmfapi
• kbolkhdnpodncbepmdejjijgkdpedgcj
• gfbhidjkgiaopiekkefehamhcmigdcna
• ekmpmfdhakdjaaifkfgpbcagdhlbamki

Bookkeeping