Minecraft Overgrown Cabin Live Wallpaper
bagjgagjbpfaeplemojgjecjcebglplb
Risk Score
8.67
Risk Level:
Critical
Recommendation:
🚫 BLOCK
Top Risks
- THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Minecraft Overgrown Cabin Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
- Uninstall AND install URL hijacks redirect to gameograf.com ad/tracking funnel.
- Minecraft brand impersonation by unverified gmail dev — no IP ownership.
- Privacy policy is generic Google account policy; does not scope this extension at all (data_collection+third_party_sharing admitted, scope_extension=false → +10).
- NewTab override with external JS contacts Google, Instagram, Netflix, YouTube, X — monetization aggregator pattern.
Evidence
- uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com with UTM campaign tracking params.
- install_url_hijack crx onInstalled opens gameograf.com with UTM params — traffic monetization on install.
- brand_impersonation store brand_mention.is_impersonation=true for 'minecraft'; developer is gmail user with no confirmed ownership.
- generic_privacy_policy api Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
- newtab_override manifest chrome_url_overrides.newtab=index.html replaces every new tab session.
- external_js_hosts crx JS contacts gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com — 6 unrelated origins.
- free_webmail_developer store Developer email ulasaskin728@gmail.com; no business domain; not verified publisher.
- search_permission_newtab_combo manifest 'search' permission combined with newtab override enables search-query monetization.
- threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Minecraft Overgrown Cabin Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 6.17 -> 8.67 (+2.5 cap 2.5).
Permissions Breakdown
- search medium Allows reading/manipulating search queries; medium risk on its own.
- chrome_url_overrides.newtab medium Replaces new-tab page; primary monetization surface for this extension.
Pillar Scores
Permissions3.00
Reputation8.50
Network2.00
Webstore10.00
Maintenance0.00
Privacy10.00
Code Quality0.00
CVE Exposure0.00
Bookkeeping
Rubric v3.6
Scored at 2026-11-03 09:52
Listing SHA
da7c11c11386…
Force block
— not fired
Score recovered
no
Elapsed
—