Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Sword Art Online Asuna and Kirito Swords Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection and 3rd-party sharing: scores maximum 10.
• Uninstall and install URL hijacks redirect users to gameograf.com with UTM tracking — classic monetization shell signal.
• NewTab override with 'search' permission: replaces every new tab and can intercept search traffic.
• innerHTML sink in popup.js with no CSP — DOM-XSS risk if input is attacker-influenced.

Evidence

• install_url_hijack manifest onInstalled opens https://gameograf.com/?utm_source=install — install redirect to 3rd-party with UTM.
• uninstall_url_hijack manifest setUninstallURL to https://gameograf.com/?utm_source=gameograf — uninstall hijack confirmed.
• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces every new tab for all 355 users.
• generic_privacy_policy store Privacy URL points to Google's own policy (myaccount.google.com/privacypolicy) — not scoped to extension.
• dom_xss_sink crx innerHTML assigned from variable in js/popup.js; no CSP present — DOM-XSS risk.
• no_developer_name store developer_name is empty string; reduces accountability for newtab monetization pattern.
• staleness store 15 months since last update — falls in 6-point maintenance band (6-12 months boundary edge).
• verified_publisher_with_monetization store Verified publisher but install/uninstall URL hijacks present; v3.5 invariant 0c caps discount at -1.0.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Sword Art Online Asuna and Kirito Swords Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.34 -> 7.84 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows search provider interaction; paired with newtab override amplifies monetization risk.
• host_permissions: https://api.gameograf.com/* medium Scoped to developer API — limited blast radius but enables data exfiltration to dev server.
• chrome_url_overrides.newtab medium Replaces every new tab — high daily reach, classic monetization surface.

Pillar Scores

Bookkeeping