Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Grimm X Leaf Black Souls Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• New-tab override with uninstall+install URL hijack to gameograf.com — classic monetization shell pattern.
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Google policy admitted as data_collection+third_party_sharing but not scoped to extension → privacy pillar maxed.
• DOM-XSS sink (innerHTML from variable) in calendar.js with no CSP present.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces every new tab with operator page.
• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?utm_source=dekuy — 3rd-party uninstall redirect confirmed.
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=dekuy — 3rd-party install redirect confirmed.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google account policy, not extension-scoped; data_collection+3rd_party_sharing true.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 — no script restriction declared.
• dom_sink_innerhtml_userctrl crx js/calendar.js assigns innerHTML from variable without sanitization — DOM-XSS risk with no CSP.
• search_permission_newtab_combo manifest search permission + newtab override enables full search traffic capture/redirection.
• no_installs_data store Install count unavailable; rating=0; new or unlisted extension with unverified publisher.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Grimm X Leaf Black Souls Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.47 -> 7.97 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying browser search; paired with newtab override enables search hijacking.
• host_permission: https://api.gameograf.com/* medium Scoped to dev API; enables data exfil to operator-controlled endpoint.
• chrome_url_overrides.newtab high Replaces new-tab page; high-reach monetization surface seen on every new tab.

Pillar Scores

Bookkeeping