Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Jujutsu Kaisen – Ryomen Sukuna Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's own policy (not scoped to this extension) and admits data collection + third-party sharing — effectively no extension-specific privacy disclosure.
• NewTab override + search permission = search-hijack / monetization vector; both install and uninstall URL hijacks confirmed.
• Two innerHTML DOM-XSS sinks with no CSP present (MV3 but csp_present==false) amplify injection risk.
• Developer name field empty; no verified business identity despite verified_publisher badge.

Evidence

• newtab_override manifest chrome_url_overrides.newtab present; replaces every new-tab page for monetization or search injection.
• uninstall_url_hijack crx setUninstallURL targets https://gameograf.com/?utm_source=extension&utm_medium=install (3rd-party tracking).
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=Sukuna&utm_medium=install.
• generic_privacy_policy store Privacy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• dom_xss_sink_no_csp crx innerHTML sinks in popup.js and calendar.js; csp_present=false amplifies DOM-XSS risk.
• no_developer_name store developer_name is empty string; reduces accountability despite verified_publisher=true.
• verified_publisher store verified_publisher=true mitigates reputation partially but does not offset privacy/monetization concerns.
• search_permission_newtab manifest search permission + newtab override is a known monetization cluster for search-redirect income.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Jujutsu Kaisen – Ryomen Sukuna Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.49 -> 7.99 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows override of search provider; typical for NewTab monetization.
• host_permissions: https://api.gameograf.com/* low Scoped to dev's own API domain; limited surface.
• chrome_url_overrides.newtab medium Replaces new-tab page; prime monetization/search-hijack vector.

Pillar Scores

Bookkeeping