Top Risks

• Google's generic privacy policy used — scope_extension=false, data_collection=true, third_party_sharing=true: privacy pillar maxes at 10.
• Large operator cluster: 5 compound siblings, 29 extensions under same dev email — factory-pattern monetization shell.
• Uninstall + install URL hijack both present: onInstalled and setUninstallURL redirect to gameograf.com with tracking params.
• New-tab override replaces every new tab; combined with search permission creates high-reach ad/search monetization surface.
• Two innerHTML DOM-XSS sinks without CSP (MV3 default only); data from api.gameograf.com could be injected into new-tab page.

Evidence

• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true — not scoped to this extension.
• operator_cluster api sibling_count=5 compound, 29 under same dev email. Factory-pattern NewTab shell producer.
• uninstall_url_hijack crx setUninstallURL → gameograf.com with UTM tracking params.
• install_url_hijack crx onInstalled opens gameograf.com with UTM tracking params.
• newtab_override manifest chrome_url_overrides.newtab=newtab.html replaces every new tab for 801 users.
• dom_xss_sink crx Two innerHTML assignments from variables in popup.js and calendar.js with no CSP to mitigate.
• no_developer_name store developer_name is empty string; verified_publisher=true but no display name in listing.
• verified_publisher store verified_publisher=true; domain resolves, age 2051 days, 265 certs — partial credibility discount applied.

Permissions Breakdown

• search medium Allows search-provider interaction; medium risk on its own but paired with newtab override raises concern.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides.newtab high Replaces new tab page — high-reach surface on every new tab open.

Pillar Scores

Operator Siblings (15)

Other extensions sharing this developer's compound fingerprint:

• kbbpgbdclanolnidddbeolaaddllgebp
• kgdahhodabbdnkkphjpneoiadhdphhna
• dihbfoicmibapnfojehonedckdjhegbe
• gfgopigkkjcinmgoancipefafljdfghd
• cdmooeifaodbcailnibfpnmbighehpkj
• iobnmhnecelingbpdadgpmalbdagjbnb
• jpmpdfcaaelghoomjgdebmoekdfkhabp
• ohpdpicjlgbpihginhijhkfdcgfbffgf
• cifonlmfhnimmghojdepepjdgbbminel
• dbomdodikcfpocimcpegpbnlmankljcb
• dmdfahkplmikmlboodadelolcmbjgmff
• ckodcbbdgmpjidpfcipfobfagemmfapi
• kbolkhdnpodncbepmdejjijgkdpedgcj
• gfbhidjkgiaopiekkefehamhcmigdcna
• ekmpmfdhakdjaaifkfgpbcagdhlbamki

Bookkeeping