Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Dragon Ball Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy — not scoped to this extension, yet admits data collection and third-party sharing: scores maximum privacy risk.
• Uninstall and install URL hijacks redirect users to gameograf.com marketing URLs — confirmed monetization shell pattern.
• NewTab override combined with search permission is primary control surface for ad/search monetization.
• No developer name supplied; verified publisher identity is thin cover for a wallpaper/NewTab monetization shell.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com UTM link; classic monetization-shell fingerprint.
• install_url_hijack crx onInstalled opens gameograf.com UTM link; stacks with uninstall hijack for double monetization signal.
• privacy_policy_generic store Policy URL is Google's global privacy policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0.
• newtab_override manifest chrome_url_overrides.newtab present; extension controls every new tab session.
• no_developer_name store developer_name is empty string; verified_publisher=true but no displayed identity.
• dom_sink_innerhtml crx js/popup.js assigns innerHTML from variable with csp_present=false — DOM-XSS risk.
• external_host_mlionltd.github.io crx js_external_hosts includes mlionltd.github.io — third-party GitHub Pages host not matching developer domain.
• stale_16mo_newtab store 16 months since last update for a NewTab extension controlling search and new tab page.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Dragon Ball Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.27 -> 7.77 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/modifying search queries; relevant for NewTab but grants search data access.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain only.
• chrome_url_overrides.newtab medium Replaces new tab page — primary monetization/control surface for this category.

Pillar Scores

Bookkeeping