Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Free Palestine Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override with uninstall+install URL hijack — classic monetization shell pattern with analytics tracking on both events.
• Privacy policy is Google's own policy (not scoped to extension) but admits data collection and third-party sharing — score +10.
• No CSP present (MV3 but csp_present==false) with innerHTML DOM-XSS sinks in popup and calendar scripts.
• Developer name field empty; verified publisher but newtab+search override triggers capability gate on discount.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces every new tab for all users.
• uninstall_url_hijack manifest setUninstallURL points to gameograf.com with UTM params — confirmed 3rd-party redirect on uninstall.
• install_url_hijack manifest onInstalled opens gameograf.com with UTM install params — confirmed 3rd-party redirect on install.
• generic_privacy_policy store Policy URL is Google's own account policy (myaccount.google.com); scope_extension=false, data_collection=true, third_party_sharing=true.
• no_csp crx content_security_policy is null and csp_present=false; innerHTML sinks in popup.js and calendar.js without CSP protection.
• dom_xss_sinks crx Two innerHTML-from-variable sinks detected (popup.js, calendar.js) with no CSP to mitigate DOM-XSS.
• verified_publisher_capability_gate store Verified publisher discount capped: newtab override + search permission are HIGH-capability — v2 gate applies.
• empty_developer_name store developer_name is empty string; no 'Offered by' identity visible to users.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Free Palestine Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.34 -> 6.84 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Search API allows overriding default search provider; paired with newtab override, significant monetization risk.
• https://api.gameograf.com/* medium Scoped host permission to developer API — enables outbound data transfer to dev-controlled endpoint.
• chrome_url_overrides.newtab medium Replaces every new tab — high reach, monetization surface, and user-tracking opportunity.

Pillar Scores

Bookkeeping