Mickey Mouse Wallpaper Gameograf
apieggaibpegfepedgdobiphmhpkjlam
Risk Score
9.70
Risk Level:
Critical
Recommendation:
🚫 BLOCK
Top Risks
- THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Mickey Mouse Wallpaper Gameograf [adware] + malext.io malicious_extension_sentry (+2.5, capped).
- Generic Google privacy policy admits data collection/sharing without extension scope.
- Uninstall and install URL hijack to gameograf.com with UTM tracking.
- NewTab extension with only 262 installs from an operator running 4+ sibling extensions.
- Developer name missing despite verified publisher badge.
Evidence
- privacy_policy_classification api Generic Google policy: scope_extension=false, data_collection=true, third_party_sharing=true → +10.0
- install_uninstall_hijack store Install and uninstall URLs redirect to gameograf.com with UTM campaign tracking.
- operator_cluster api Compound fingerprint matches 4 sibling extensions from same developer.
- verified_publisher_cap store Verified publisher discount capped at -1.0 because monetization_hits or stale > 18mo.
- newtab_override_low_installs manifest NewTab override with only 262 installs — low blast radius but high option value.
- code_quality_dom_sink crx innerHTML sink with no CSP present → +2.0 (FIX B triggered).
- maintenance_stale store 16 months since last update; moderately stale.
- developer_name_missing store No developer name displayed despite verified publisher status.
- threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Mickey Mouse Wallpaper Gameograf [adware] + malext.io malicious_extension_sentry; score 7.20 -> 9.70 (+2.5 cap 2.5).
Permissions Breakdown
- search low Search API; low risk in isolation.
- host_permissions: https://api.gameograf.com/* low Scoped to developer's own API subdomain.
- chrome_url_overrides.newtab medium Overrides new tab page; classic monetization surface.
Pillar Scores
Permissions5.20
Reputation4.00
Network2.00
Webstore9.00
Maintenance3.50
Privacy10.00
Code Quality2.00
CVE Exposure0.00
Operator Siblings (4)
Other extensions sharing this developer's compound fingerprint:
Bookkeeping
Rubric v3.6
Scored at 2026-11-03 09:52
Listing SHA
6743d23352df…
Force block
— not fired
Score recovered
no
Elapsed
—