Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Christmas Tree Lights Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy (not extension-scoped), admits data collection and 3rd-party sharing — scored maximum privacy risk.
• New-tab override replaces every tab; combined with uninstall/install URL hijacks this is a clear monetization shell pattern.
• Install and uninstall URL hijacking to gameograf.com — tracks user lifecycle for monetization.
• No content security policy (MV3 null CSP) combined with innerHTML sinks in popup.js and calendar.js creates DOM-XSS exposure.

Evidence

• chrome_url_overrides.newtab manifest Extension overrides new tab page — high-reach surface for every browser session.
• uninstall_url_hijack + install_url_hijack crx Both onInstalled and uninstall events redirect to gameograf.com UTM URLs — monetization lifecycle tracking.
• privacy_policy_generic store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension; data_collection=true, third_party_sharing=true.
• dom_sink_innerhtml_userctrl crx innerHTML sinks in popup.js and calendar.js; no CSP present — DOM-XSS risk.
• csp_present=false manifest MV3 extension with null content_security_policy; no mitigation for inline script injection.
• no_developer_name store developer_name is empty string; verified_publisher=true but no display name shown.
• new_tab_override_monetization manifest newtab override + search permission + install/uninstall hijack = monetization shell pattern.
• verified_publisher store Verified publisher badge present; discount applied but capped due to generic privacy policy and monetization signals.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Christmas Tree Lights Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.23 -> 7.73 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying search provider; relevant to NewTab override monetization.
• host_permissions: https://api.gameograf.com/* medium Scoped to developer API domain; enables data exfil to own backend.
• chrome_url_overrides.newtab medium Replaces every new tab; high-reach monetization surface.

Pillar Scores

Bookkeeping