Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Itachi’s Throne Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override paired with uninstall/install URL hijacks — classic monetization shell pattern.
• Privacy policy points to Google's own policy (scope_extension=false, data_collection=true, third_party_sharing=true) — effectively no scoped disclosure.
• Operator cluster: 4 compound siblings, 25 dev-email siblings — mass-produced wallpaper factory pattern.
• Two innerHTML DOM-XSS sinks in popup.js and calendar.js with no CSP to mitigate.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces every new tab for all users.
• uninstall_url_hijack crx setUninstallURL targets https://gameograf.com with UTM tracking params.
• install_url_hijack crx onInstalled opens https://gameograf.com with UTM install tracking params.
• privacy_policy_generic store Policy URL is Google's own privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• operator_cluster api 25 siblings by dev_email, 4 compound-fingerprint siblings — wallpaper factory operator.
• dom_xss_sinks crx innerHTML from variable in popup.js and calendar.js; no CSP present to restrict execution.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening declared.
• developer_name_blank store developer_name is empty string despite verified_publisher=true — reduced accountability.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Itachi’s Throne Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.42 -> 7.92 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying the browser's search service; medium risk paired with NewTab override.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain only.
• chrome_url_overrides.newtab medium Replaces new-tab page; significant user-facing surface and monetization vector.

Pillar Scores

Operator Siblings (15)

Other extensions sharing this developer's compound fingerprint:

• kbbpgbdclanolnidddbeolaaddllgebp
• kgdahhodabbdnkkphjpneoiadhdphhna
• dihbfoicmibapnfojehonedckdjhegbe
• gfgopigkkjcinmgoancipefafljdfghd
• pjbnoadhjobchdjkfhpehlbigakbjfii
• iobnmhnecelingbpdadgpmalbdagjbnb
• jpmpdfcaaelghoomjgdebmoekdfkhabp
• ohpdpicjlgbpihginhijhkfdcgfbffgf
• cifonlmfhnimmghojdepepjdgbbminel
• dbomdodikcfpocimcpegpbnlmankljcb
• dmdfahkplmikmlboodadelolcmbjgmff
• ckodcbbdgmpjidpfcipfobfagemmfapi
• kbolkhdnpodncbepmdejjijgkdpedgcj
• gfbhidjkgiaopiekkefehamhcmigdcna
• ekmpmfdhakdjaaifkfgpbcagdhlbamki

Bookkeeping