Top Risks

• NewTab override with uninstall+install URL hijack to gameograf.com — classic monetization shell pattern.
• Two innerHTML DOM-XSS sinks (popup.js, calendar.js) with no CSP, raising exploit surface.
• No developer name listed despite verified publisher; low install count (140) limits blast radius.
• Privacy policy scoped but third-party sharing disclosed — data flows to external parties.
• Search permission combined with newtab override signals potential search-query monetization.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html — replaces every new tab page.
• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?utm_source=extension&utm_medium=install
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install
• dom_xss_sink crx innerHTML assigned from variable in popup.js and calendar.js; no CSP to mitigate.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• no_developer_name store developer_name is empty string despite verified_publisher == true.
• verified_publisher store Extension carries verified publisher badge for gameograf.com (resolves, not throwaway).
• privacy_policy_third_party api Privacy policy fetched; third_party_sharing == true with retention disclosed.

Permissions Breakdown

• search medium Allows reading/modifying search queries; notable for a wallpaper/NewTab extension.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; required for extension functionality.
• chrome_url_overrides.newtab medium Replaces new tab page — primary monetization surface for this category.

Pillar Scores

Bookkeeping