Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Vintage Pixel Car Road Trip Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override replaces every new tab — high-reach search monetization surface on 50 installs with growth potential.
• Uninstall URL hijack + install URL hijack both redirect to gameograf.com UTM-tagged URL — confirmed traffic monetization pattern.
• No CSP (csp_present=false, MV3) + innerHTML sinks in popup.js and calendar.js = DOM-XSS exposure.
• Developer name field empty; 'search' permission + newtab override = classic search-hijack shell pattern.

Evidence

• newtab_override manifest chrome_url_overrides.newtab=newtab.html — every new tab replaced; paired with 'search' permission.
• uninstall_url_hijack crx setUninstallURL -> https://gameograf.com/?utm_source=extension&utm_medium=install (3rd-party UTM).
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install.
• no_csp_mv3 manifest content_security_policy is null on MV3; dom_sink_innerhtml_userctrl findings in popup.js and calendar.js.
• external_host_scope_mismatch crx js_external_hosts includes chat.openai.com, 6 Google workspace domains — inconsistent with wallpaper/NewTab claim.
• developer_name_missing store developer_name is empty string; no 'Offered by' attribution visible.
• verified_publisher store verified_publisher=true; discount capped because monetization pattern (install/uninstall hijacks) present.
• privacy_policy_adequate api Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true — fully scored.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Vintage Pixel Car Road Trip Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.10 -> 6.60 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/modifying search provider; paired with newtab override raises monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab — high-reach entry point for search monetization and ad injection.
• host_permissions: https://api.gameograf.com/* medium Scoped to dev domain; enables data exfil to controlled API endpoint.

Pillar Scores

Bookkeeping