Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Cool Car Street Burnout Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override captures every new tab opened by user — high-reach data and monetization surface.
• Uninstall and install URL hijacks redirect to gameograf.com tracking URL — classic monetization shell.
• No developer name listed; thin identity accountability for a persistent newtab replacement.
• Two DOM-XSS innerHTML sinks with no CSP — server-side data from api.gameograf.com could inject HTML.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — every new tab is controlled by this extension.
• uninstall_url_hijack crx setUninstallURL points to https://gameograf.com/?utm_source=extension&utm_medium=install
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit restriction.
• dom_xss_sink crx innerHTML user-controlled assignments in popup.js and calendar.js without sanitization.
• no_developer_name store developer_name is empty string; accountability gap for a newtab replacement.
• verified_publisher store Extension carries verified_publisher=true; partial trust credit applied.
• privacy_policy_third_party_sharing api Policy admits data collection and third-party sharing; scoped to extension domain.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Cool Car Street Burnout Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 2.88 -> 5.38 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying browser search providers; paired with newtab override increases risk.
• host_permissions: https://api.gameograf.com/* medium Scoped to dev domain; used for extension API calls but data exfil path exists.
• chrome_url_overrides.newtab medium Replaces every new tab — high-reach surface for monetization and data collection.

Pillar Scores

Bookkeeping