Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Hello Kitty 4K Live wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override replaces every new tab — persistent monetization/redirect surface with 'search' permission.
• Privacy policy is Google's own generic policy (scope_extension=false, admits data collection + 3rd-party sharing) — scores maximum privacy risk.
• Uninstall and install URL hijacks redirect to gameograf.com utm-tracked pages — traffic monetization pattern.
• No CSP (csp_present=false) + innerHTML DOM-XSS sink in popup.js with no mitigating controls.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html; replaces every new tab with wallpaper/search monetization page.
• install_uninstall_hijack crx Both onInstalled and uninstall URLs redirect to gameograf.com with UTM params — traffic monetization.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — Google's policy, not scoped to this extension.
• privacy_admits_collection_sharing api Classification: scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (rule D).
• dom_xss_sink_no_csp crx innerHTML from variable in popup.js with csp_present=false triggers elevated code-quality risk.
• verified_publisher store Verified publisher gameograf.com resolves; discount capped due to generic-policy privacy issue (invariant 0c/E).
• stale_16mo store 16 months since update → Maintenance +6.0 band.
• no_developer_name store developer_name is empty string; +1.0 Reputation penalty.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Hello Kitty 4K Live wallpaper [adware] + malext.io malicious_extension_sentry; score 4.75 -> 7.25 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding or intercepting search queries; medium risk in isolation.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces every new tab — high-reach monetization surface.

Pillar Scores

Bookkeeping