Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Lone Cherry Blossom Tree Animation Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• NewTab override with uninstall URL hijack and install URL hijack — monetization shell pattern.
• No CSP declared (MV3 default applies but csp_present==false); innerHTML DOM-XSS sink in popup.js.
• Developer name field empty; 15 months since last update with newtab+search override raises abandonment/sale risk.

Evidence

• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — every new tab replaced by extension.
• uninstall_url_hijack crx setUninstallURL targets gameograf.com with UTM params — monetization signal +3.0 webstore.
• install_url_hijack crx onInstalled opens gameograf.com with UTM params — install hijack +2.0 webstore.
• dom_sink_innerhtml_userctrl crx popup.js assigns innerHTML from variable; no CSP to mitigate DOM-XSS risk.
• verified_publisher_cap store Verified publisher but monetization URL hijacks present; 0c cap limits discount to -1.0.
• developer_name_missing store developer_name is empty string; reduces accountability signal.
• maintenance_stale store 15 months since last update with newtab+search override active raises acquisition/neglect risk.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Lone Cherry Blossom Tree Animation Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.38 -> 7.88 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/manipulating search queries; medium risk in a NewTab context.
• host_permissions: https://api.gameograf.com/* low Scoped to developer-owned API domain only.
• chrome_url_overrides.newtab medium Replaces every new tab; high reach monetization surface for ad injection.

Pillar Scores

Bookkeeping