Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Neon Captain America Shield Glow Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's own generic policy — scope_extension=false, data_collection=true, third_party_sharing=true; entirely unscoped to this extension.
• NewTab override + 'search' permission enables full search-interception monetization surface on every new tab.
• Uninstall and install URL hijacks both redirect to gameograf.com UTM tracking URL.
• No developer name listed; verified_publisher but no 'Offered by' identity increases accountability gap.

Evidence

• newtab_override manifest chrome_url_overrides.newtab=newtab.html — controls every new tab page for 78 installs.
• uninstall_url_hijack crx setUninstallURL -> https://gameograf.com/?utm_source=extension&utm_medium=install
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install
• privacy_policy_generic api Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• dom_xss_sink_no_csp crx 2x innerHTML from variable in popup.js and calendar.js; csp_present=false amplifies risk.
• no_developer_name store developer_name is empty string; verified_publisher=true but no visible 'Offered by' identity.
• search_permission_newtab manifest 'search' permission + newtab override = classic search-monetization shell pattern.
• js_external_hosts_broad crx 12 external JS hosts including chat.openai.com and multiple Google services beyond stated newtab function.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Neon Captain America Shield Glow Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.76 -> 7.26 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading search queries; combined with NewTab override enables search interception.
• host_permissions: https://api.gameograf.com/* medium Scoped to developer API; enables data exfiltration to dev-controlled endpoint.
• chrome_url_overrides.newtab medium Replaces every new tab; high-reach surface for monetization and search hijack.

Pillar Scores

Bookkeeping