Top Risks

• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and third-party sharing (Privacy +10.0).
• NewTab override + uninstall/install URL hijack to gameograf.com = monetization shell pattern (+2.0+3.0+2.0 Webstore).
• No developer name listed; verified publisher badge alone does not offset anonymity + generic policy.
• DOM-XSS sink (innerHTML from variable) in calendar.js with no CSP; MV3 default-CSP partially mitigates but no explicit policy declared.
• Extension contacts 12 external JS hosts including chat.openai.com/Google services beyond stated wallpaper function.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces every new tab; core monetization surface.
• uninstall_url_hijack crx setUninstallURL → gameograf.com/?p=33401?utm_source=extension&utm_medium=uninstall (+3.0 Webstore).
• install_url_hijack crx onInstalled opens gameograf.com/?p=33401?utm_source=extension&utm_medium=install (+2.0 Webstore).
• generic_privacy_policy api Policy URL is Google account policy: scope_extension=false, data_collection=true, third_party_sharing=true → Privacy +10.0.
• dom_xss_sink crx innerHTML assigned from variable in js/calendar.js; no explicit CSP declared (csp_present=false).
• broad_js_external_hosts crx 12 external JS hosts including chat.openai.com — far beyond wallpaper function; no CSP to restrict them.
• no_developer_name store developer_name is empty string; verified_publisher=true partially offsets but anonymity remains.
• csp_absent manifest content_security_policy is null; MV3 default applies but no explicit restriction on connect-src/script-src.

Permissions Breakdown

• search medium Allows reading/manipulating search queries; combined with NewTab override amplifies search monetization risk.
• alarms low Schedules background tasks; low standalone risk.
• storage low Stores local extension data; low risk.
• host_permissions: https://api.gameograf.com/* medium Allows XHR to developer-controlled API; scoped but enables data exfiltration to dev server.
• chrome_url_overrides.newtab medium Replaces new tab page; primary surface for search monetization and user tracking.

Pillar Scores

Bookkeeping