Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Black Car White Smoke Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override hijacks every new tab; part of operator cluster of 24 sibling extensions under same dev email.
• Privacy policy URL returns connection error (fetch_error) — effectively no readable policy.
• Uninstall and install URL hijacks redirect to gameograf.com with UTM tracking.
• innerHTML DOM-XSS sinks in popup.js and calendar.js with no CSP to mitigate.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html; replaces every new tab for 245 users.
• uninstall_url_hijack crx setUninstallURL -> https://gameograf.com/?utm_source=extension&utm_medium=install
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install
• operator_cluster api 6 compound siblings; dev_email bucket has 24 extensions under support@gameograf.com.
• privacy_policy_fetch_error api fetch_error:ConnectionError on https://api.gameograf.com/gameograf-privacy-policy.html — policy unreadable.
• dom_xss_sinks crx innerHTML from variable in js/popup.js and js/calendar.js; no CSP present.
• no_developer_name store developer_name is empty string; reduces accountability.
• search_permission_newtab manifest search permission combined with newtab override; typical monetization-shell pattern.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Black Car White Smoke Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.53 -> 8.03 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/manipulating search queries; paired with newtab override elevates risk.
• host_permissions: https://api.gameograf.com/* low Scoped to dev-owned domain only; used for extension API calls.
• chrome_url_overrides.newtab medium Replaces every new-tab page; high-reach surface for monetization or tracking.

Pillar Scores

Operator Siblings (15)

Other extensions sharing this developer's compound fingerprint:

• fdjpcjggpgdmdikmhoagohakklihimbo
• ammndifopdgpjcpmpbdenfcafipnejlj
• ojhigfemmjpjnmhidflhdlcahgdiiija
• ieocbmlfbinpcffofcjmpbjokkfghodc
• faaegcmakhlmoheamicddkfcmmjoljnd
• amfeinhgbpnnjihjiomibeodnainnjkd
• hlacaekdajdgiiofjplpofbgebgjbnco
• lcoeefcacppckhidgmkdlnbeajkmeick
• kngkldhmcncemclgjgbbogplfeoppkll
• gfcbimjpmoeofbmnjedjfkemdinagkmp
• kmjgnidfglamdnllpoidpfikcodjapih
• heakmhbelclpalglpiceoocofnkcjefb
• gbeldgdcloiceglhpdnkhbafeoddjehm
• epjpkhahnajkdjjfkeadcgfmfjfgdohf
• fjmlhfejlohohljeioedcliggbfkihdf

Bookkeeping