Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Naruto Uzumaki Purple Power Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and third-party sharing (Privacy +10.0).
• NewTab override + uninstall URL hijack + install URL hijack: classic monetization/traffic-capture shell pattern.
• Uninstall URL hijack to gameograf.com with UTM tracking parameters (Webstore +3.0).
• Install URL hijack opens third-party URL on installation (Webstore +2.0).

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — captures every new tab.
• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?utm_source=gameograf&utm_campaign=bg&utm_content=uninstall
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install&utm_campaign=bg&utm_content=install
• generic_privacy_policy api Privacy URL is Google's own policy (myaccount.google.com/privacypolicy); scope_extension=false, data_collection=true, third_party_sharing=true.
• dom_xss_sinks_no_csp crx Two innerHTML sinks (popup.js, calendar.js) with csp_present=false — DOM-XSS risk elevated.
• no_developer_name store developer_name is empty string; no 'Offered by' identity disclosed.
• verified_publisher store Verified publisher badge present (support@gameograf.com); discount applied but capped per v3.5(E) due to generic policy.
• maintenance_3_6mo store 10 months since last update; maintenance pillar +3.5.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Naruto Uzumaki Purple Power Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.33 -> 7.83 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying browser search; medium risk for NewTab override context.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API endpoint; low risk on its own.
• chrome_url_overrides: newtab medium Replaces new tab page; monetization vector, captures every new tab event.

Pillar Scores

Bookkeeping