Top Risks

• Privacy policy URL returns HTTP error — effectively no accessible privacy policy for a NewTab extension.
• Uninstall and install URL hijack both fire to gameograf.com tracking URLs — monetization shell pattern.
• NewTab override combined with operator cluster (10 sibling extensions under same dev email) signals farm.
• Two innerHTML DOM-XSS sinks with no CSP elevate injection risk on the always-visible new-tab surface.
• Developer name blank; verified publisher discount limited by monetization signals and missing policy.

Evidence

• privacy_policy_fetch_failed api privacy_policy_classification.fetched=false; fetch_error:HTTPError — policy URL unreachable, scored as no policy.
• uninstall_url_hijack crx uninstall_url_hijack=true targeting gameograf.com with UTM params — monetization shell indicator.
• install_url_hijack crx install_url_hijack=true targeting gameograf.com with UTM params — stacks with uninstall hijack.
• newtab_override manifest chrome_url_overrides.newtab present — high-frequency surface replacement on every new tab.
• operator_cluster api sibling_count=2 by compound fingerprint; dev_email dimension shows 10 siblings — extension farm signal.
• dom_xss_sinks crx 2x dom_sink_innerhtml_userctrl in popup.js and calendar.js; no CSP present (csp_present=false).
• no_developer_name store developer_name is empty string; reduces accountability despite verified_publisher=true.
• newtab_search_engine_count api search_engine_count=1 (google only); no multi-search-engine aggregator penalty applies.

Permissions Breakdown

• search medium Allows reading/modifying search queries; medium risk in a NewTab override context.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces new-tab page; high-frequency surface, monetization vector.

Pillar Scores

Operator Siblings (15)

Other extensions sharing this developer's compound fingerprint:

• fdjpcjggpgdmdikmhoagohakklihimbo
• ammndifopdgpjcpmpbdenfcafipnejlj
• ieocbmlfbinpcffofcjmpbjokkfghodc
• faaegcmakhlmoheamicddkfcmmjoljnd
• amfeinhgbpnnjihjiomibeodnainnjkd
• ceoamfmlgefiljnligpdkdindckojbim
• hlacaekdajdgiiofjplpofbgebgjbnco
• lcoeefcacppckhidgmkdlnbeajkmeick
• kngkldhmcncemclgjgbbogplfeoppkll
• gfcbimjpmoeofbmnjedjfkemdinagkmp
• kmjgnidfglamdnllpoidpfikcodjapih
• heakmhbelclpalglpiceoocofnkcjefb
• gbeldgdcloiceglhpdnkhbafeoddjehm
• epjpkhahnajkdjjfkeadcgfmfjfgdohf
• fjmlhfejlohohljeioedcliggbfkihdf

Bookkeeping