Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — The Apothecary Diaries Wallpapers [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy — does not scope to this extension; admits data collection and 3rd-party sharing.
• Uninstall and install URL hijacking redirect to gameograf.com with UTM tracking (+3.0+2.0 webstore).
• NewTab override with search provider override — monetization shell pattern; bit.ly affiliate hit.
• Months since update = 16 — stale; verified-publisher discount capped to -1.0 per invariant 0c (>18mo threshold not yet crossed but combined signals elevate maintenance).

Evidence

• uninstall_url_hijack manifest setUninstallURL → gameograf.com with UTM params; +3.0 webstore.
• install_url_hijack manifest onInstalled opens gameograf.com with UTM params; +2.0 webstore.
• newtab_override manifest chrome_url_overrides.newtab = index.html; NewTab monetization surface.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (D rule).
• affiliate_hit_bitly crx bit.ly in js_external_hosts; affiliate/cloaking redirector; +1.5 webstore.
• dom_sink_innerhtml_no_csp crx innerHTML from variable in popup.js; csp_present=false → +2.0 code quality (FIX B).
• no_developer_name store developer_name is empty string; +1.0 reputation.
• maintenance_stale store 16 months since update → +6.0 maintenance pillar.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — The Apothecary Diaries Wallpapers [adware] + malext.io malicious_extension_sentry; score 5.49 -> 7.99 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding search provider — medium risk for a NewTab extension.
• host_permissions: https://api.gameograf.com/* low Scoped to dev's own API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces new-tab page; monetization surface, per v2 calibration scored as MEDIUM.

Pillar Scores

Bookkeeping