Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Minato and Naruto Live Wallpaper - New Tab Theme [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall and install URL hijack to gameograf.com tracking — monetization shell pattern.
• New-tab override with search override creates high-reach search monetization surface.
• Two innerHTML DOM-XSS sinks without CSP (MV3 default CSP present but csp_present==false signals no explicit policy).
• No developer name disclosed in store listing; 87 installs with newtab+search override is tail-attack surface.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL to gameograf.com with UTM params — monetization shell indicator.
• install_url_hijack crx onInstalled opens gameograf.com with UTM params — install-redirect pattern.
• newtab_override manifest chrome_url_overrides.newtab replaces new-tab page; combined with search permission = monetization vector.
• dom_sink_innerhtml crx Two innerHTML sinks in popup.js and calendar.js without explicit CSP — DOM-XSS risk.
• no_csp manifest content_security_policy is null; csp_present==false raises code quality risk for innerHTML findings.
• verified_publisher store gameograf.com resolves, not throwaway; verified publisher reduces reputation risk.
• privacy_policy_adequate api Policy fetched, scoped to extension, discloses data collection, retention, and third-party sharing.
• js_external_hosts crx 12 external JS hosts including Google services and api.gameograf.com; geo diversity limited to CA/US.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Minato and Naruto Live Wallpaper - New Tab Theme [adware] + malext.io malicious_extension_sentry; score 2.86 -> 5.36 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/modifying search queries; typical for NewTab but adds capability.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; expected for a NewTab theme fetching content.
• chrome_url_overrides.newtab medium Replaces new-tab page — primary NewTab monetization vector.

Pillar Scores

Bookkeeping