Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Head Soccer Head Ball Gameograf [adware] [divergent] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy URL unreachable (ConnectionError) — effectively no accessible policy for users.
• Extension is 26 months stale with only 270 installs — zombie fingerprint, abandonment risk.
• Uninstall URL hijack registered — redirects users to external page on removal.
• Install URL hijack registered — opens external page on first install.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() called; target null but hijack flag set — user redirected on uninstall.
• install_url_hijack crx onInstalled opens external URL; target null but hijack flag set — opens page on install.
• privacy_policy_fetch_error api Privacy policy URL https://www.play.gameograf.com/privacy returned ConnectionError — unreachable, treated as no policy.
• maintenance_stale store Last updated July 14 2024; 26 months since update — scores +8.5 maintenance.
• no_developer_name store developer_name is empty string; identity accountability reduced.
• verified_publisher store Extension has verified_publisher=true; applied -3.0 reputation discount (floor 2.0).
• manifest_localization_only manifest manifest_name and manifest_description are MSG placeholders; no inline description visible for review.
• js_external_hosts crx External JS hosts: gameograf.com, www.play.gameograf.com — both on same dev domain, no third-party CDN.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Head Soccer Head Ball Gameograf [adware] [divergent] + malext.io malicious_extension_sentry; score 4.93 -> 7.43 (+2.5 cap 2.5).

Pillar Scores

Bookkeeping