Is Satoru Gojo: Unleash the Power of Jujutsu! Gameograf safe?

Medium risk

Satoru Gojo: Unleash the Power of Jujutsu! Gameograf fetches remote Gameograf HTML and injects it into its new-tab page.

When a new tab opens, the extension requests a message file from api.gameograf.com, reads its HTML and timestamp fields, and displays newer HTML inside the extension page. The source shows this remote content path in the extension's own new-tab UI, with no content scripts or webpage bridge identified.

Gameograf.comv3.2.0Chrome Web Store
45Risk
Who publishes it

Gameograf.com - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Gameograf.com

Same store account

1 other listing published from this account, 2k+ users between them, none of them carrying a finding.

Lamborghini wallpapers2k+Low

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

New tab page injects remote HTML fetched from api.gameograf.com

Every new tab you open makes the extension fetch HTML from api.gameograf.com and write it into the page with innerHTML.

We captured a live request and confirmed the returned markup appears on the page.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

You open a new browser tab.

This extension overrides Chrome's new-tab page with its own index.html.

The extension did this

The page fetches HTML from api.gameograf.com and writes it directly into the tab.

The fetched html field is assigned to a container element with innerHTML, not appended as text.

Captured request
GEThttps://api.gameograf.com/popup/message.json

200 OK, JSON body: {"html":"<strong>ONE extension, thousands of wallpapers.</strong>...","title":"ONE extension, thousands of wallpapers.","message":"Customize Chrome with thousands of wallpapers using the \"Gameograf One\" extension.","buttonText":"Download Now","buttonUrl":"https://chromewebstore.google.com/detail/nhejmbfiliencnlokacfmgjccfoecmai","timestamp":1788534414087}

Fields in the fetched response
  • HTML markup
    <strong>ONE extension, thousands of wallpapers.</strong><p>...</p><a href='https://chromewebstore.google.com/...'>Download Now</a>

    Raw HTML written into your new-tab page without sanitization.

  • Title
    ONE extension, thousands of wallpapers.

    A heading shown inside the injected content.

  • Button link
    https://chromewebstore.google.com/detail/nhejmbfiliencnlokacfmgjccfoecmai

    Destination the injected content links out to.

  • Timestamp
    1788534414087

    Used to decide whether to show this content again on your next new tab.

The code that does this

The fetch-and-inject handler

Readable version

Same source, this extension ships readable code

js/popup.js
fetch("https://api.gameograf.com/popup/message.json")    .then((res) => {        if (!res.ok) throw new Error("Failed to retrieve notification data");        return res.json();    })    .then((data) => {        const { html, timestamp } = data;        const lastShown = parseInt(localStorage.getItem(lastShownKey) || "0");        if (timestamp > lastShown) {            popupContainer.innerHTML = html;            popupContainer.style.display = "block";            localStorage.setItem(lastShownKey, timestamp.toString());        }    });
Where the injected markup comes from
    • api.gameograf.com

    Serves promotional HTML that this extension injects into its own new-tab page. Operated by the same publisher as the extension.

Reproduce it yourself

Fetches the same endpoint the extension calls and prints the html field it would inject into your new-tab page.

Requires
  • Node.js 18+
check-popup-endpoint.js · js
fetch("https://api.gameograf.com/popup/message.json")  .then((res) => res.json())  .then((data) => {    console.log("timestamp:", data.timestamp);    console.log("html to be injected:\n", data.html);  })  .catch((err) => console.error("request failed:", err));
How to run it
  1. 1Save as check-popup-endpoint.js.
  2. 2Run with `node check-popup-endpoint.js` (Node 18+ has fetch built in).
  3. 3Compare the printed html against what appears on a fresh new tab.

What it can do

Permissions this extension asks for, as declared in version 3.2.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on api.gameograf.com

    https://api.gameograf.com/*

  • Run searches with your default search engine

    search

Where it sends data

Destinations our analysis observed Satoru Gojo: Unleash the Power of Jujutsu! Gameograf contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.gameograf.comwidely used

    Satoru Gojo: Unleash the Power of Jujutsu! Gameograf sends data to api.gameograf.com. A widely used service: 48 other extensions we have analysed send data here.

Updated 30 September 2026ohaanogfieieninnekoplcannhhagbih