Sonic the Hedgehog

Version 2.60 View in Chrome Web Store

Last scanned: about 1 hour ago

Extension Details

Developer: https://gameograf.com/

Rating: 4.7 ★ (30 ratings)

Users: 3,000

Context-Aware Verdict

MEDIUM

Overall Risk

Trust Factors: The extension has a decent user base of 3,000 users and maintains a high rating of 4.7 stars from 30 reviews, suggesting positive user experiences. The developer website gameograf.com appears to be a gaming-focused platform, which aligns with the Sonic the Hedgehog theme. However, the limited developer information and relatively small user base compared to major extensions raises some concerns about long-term support and transparency.

Concerns: The primary concern is the host permission for https://api.gameograf.com/*, which allows the extension to communicate with the developer's API. While not as broad as wildcard permissions, this still enables data transmission to external servers. The "search" permission could potentially be used to monitor or modify search queries. The combination of these permissions with limited transparency about what data is collected or transmitted creates privacy risks. The extension's actual functionality isn't clearly described, making it difficult to assess whether these permissions are necessary.

Recommendations: Consider running this extension in a separate Chrome profile if you're concerned about privacy. Before installing, visit the developer's website to understand their privacy practices and data handling policies. Monitor your browser's network activity to see what data the extension transmits to the gameograf.com API. Given the gaming theme, ensure this extension provides legitimate gaming functionality rather than serving as a data collection tool disguised as entertainment.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

Security Analysis Details

Required Permissions:

Host Permissions:

https://api.gameograf.com/*

Embedded URLs (14 total):

https://fonts.googleapis.com	https://fonts.gstatic.com
https://fonts.googleapis.com/css2?family=Poppins:ital	https://fonts.googleapis.com/css2?family=Material+Symbols+Outlined:opsz
https://clients2.google.com/service/update2/crx	https://api.gameograf.com/
https://chrome.google.com/webstore/detail/	https://gameograf.com/top-100/
https://gameograf.com/privacy-policy	https://api.gameograf.com/popup/message.json
https://gameograf.com/?utm_source=install&utm_medium=link&utm_campaign=bg&utm_content=install	https://gameograf.com/?utm_source=gameograf&utm_medium=link&utm_campaign=bg&utm_content=uninstall
https://api.gameograf.com/js/shortcuts.json	https://www.google.com/s2/favicons?domain=

Raw Manifest

{
  "name": "__MSG_appName__",
  "icons": {
    "16": "img/128.png",
    "48": "img/128.png",
    "128": "img/128.png"
  },
  "author": "Gameograf",
  "version": "2.60",
  "background": {
    "service_worker": "js/bg.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_appDesc__",
  "permissions": [
    "search"
  ],
  "default_locale": "en",
  "host_permissions": [
    "https://api.gameograf.com/*"
  ],
  "manifest_version": 3,
  "chrome_url_overrides": {
    "newtab": "newtab.html"
  }
}

by ✦ Astarte