Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Bakugo Explosion My Hero Academia Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy URL returns fetch error — effectively no accessible policy; privacy pillar maxed at 10.0.
• NewTab override replaces every browser new tab with developer-controlled wallpaper page.
• Uninstall and install URL hijacks redirect to developer domain for tracking.
• Two innerHTML DOM-XSS sinks found in popup.js and calendar.js with no CSP to mitigate.

Evidence

• privacy_policy_fetch_failed api privacy_policy_classification.fetched=false; HTTPError — policy inaccessible, treated as no policy.
• newtab_override manifest chrome_url_overrides.newtab=newtab.html; every new tab controlled by developer.
• uninstall_url_hijack crx setUninstallURL to gameograf.com with UTM tracking params on uninstall.
• install_url_hijack crx onInstalled opens gameograf.com with UTM tracking params on install.
• dom_xss_sinks crx Two innerHTML-from-variable sinks in popup.js and calendar.js; no CSP present to block exploitation.
• no_developer_name store developer_name is empty string; reduced accountability for extension operator.
• verified_publisher store verified_publisher=true; partial reputation credit but capped due to install/uninstall hijacks.
• newtab_monetization_shape manifest NewTab override + install/uninstall UTM hijacks form classic traffic-monetization shell pattern.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Bakugo Explosion My Hero Academia Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.42 -> 6.92 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading and potentially influencing search queries; relevant to NewTab/search override.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; expected for wallpaper content delivery.
• chrome_url_overrides.newtab medium Replaces every new tab with developer-controlled page; persistent reach on every browser open.

Pillar Scores

Bookkeeping