Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Garena Free Fire Gameograf [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall and install URL hijacks redirect to gameograf.com with UTM tracking on every install/uninstall.
• NewTab override with 1,000 installs — classic traffic-monetization shell; +2.0 new-tab override, +3.0 uninstall hijack, +2.0 install hijack scored in Webstore.
• Stale extension: 15 months since update; Maintenance scores 6.0 (6-12mo band).
• Developer name missing; verified publisher but no 'Offered by' display name increases impersonation ambiguity.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL points to gameograf.com with UTM params — 3rd-party redirect on uninstall.
• install_url_hijack manifest onInstalled opens gameograf.com with UTM install params — engagement tracking on install.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html replaces every new-tab page for all users.
• csp_absent crx content_security_policy is null; no CSP declared on MV3 extension.
• dom_sink_innerhtml_userctrl crx js/popup.js: innerHTML assignment from variable — DOM-XSS sink without CSP guard.
• developer_name_missing store developer_name is empty string; no 'Offered by' visible on listing.
• verified_publisher store Extension has verified_publisher=true; caps Reputation discount but 15mo stale triggers 0c cap at -1.0.
• maintenance_stale store months_since_update=15; falls in 12-24mo band → +6.0 Maintenance pillar.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Garena Free Fire Gameograf [adware] + malext.io malicious_extension_sentry; score 4.34 -> 6.84 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying/modifying browser search; medium risk for a NewTab override extension.
• host_permissions: https://api.gameograf.com/* low Scoped to own API domain only; narrow host access.
• chrome_url_overrides.newtab medium Replaces new-tab page; classic monetization/redirect vector per v2 rule (a).

Pillar Scores

Bookkeeping