Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Toyota Supra MK4 Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy (not scoped to extension) and admits data collection & 3rd-party sharing.
• NewTab override replaces every new tab; combined with uninstall and install URL hijacks signals monetization shell.
• Uninstall URL hijack redirects to gameograf.com; install URL opens unrelated Stranger Things promo — classic traffic farm.
• No developer name listed; verified publisher discount limited by URL hijack pattern.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces every new tab page.
• uninstall_url_hijack crx setUninstallURL targets gameograf.com with UTM tracking — 3rd-party redirect on removal.
• install_url_hijack crx onInstalled opens Stranger Things promo page — unrelated product cross-promotion.
• generic_privacy_policy api Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension.
• privacy_admits_collection_sharing api Classification: scope_extension=false, data_collection=true, third_party_sharing=true → worst-case policy.
• dom_xss_no_csp crx 2 innerHTML sinks in popup.js and calendar.js; csp_present=false increases DOM-XSS exploitability.
• no_developer_name store developer_name is empty string; verified_publisher=true but name not displayed.
• search_engine_count_1_newtab api search_engine_count=1 (google.com); no multi-engine aggregator risk but search permission still present.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Toyota Supra MK4 Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.16 -> 7.66 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying browser search; combined with newtab override enables search provider manipulation.
• chrome_url_overrides.newtab high Replaces every new tab — high reach, monetization vector, paired with search permission.
• host_permissions: https://api.gameograf.com/* medium Outbound API calls to developer's own domain; low blast radius but enables data exfil channel.

Pillar Scores

Bookkeeping