Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — (G)I-Dle Gidle Live Wallpaper New Tab [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override with install/uninstall URL hijack to gameograf.com — fan-content monetization shell pattern.
• Uninstall URL hijack sends tracking UTM parameters to third-party on removal.
• Install URL hijack opens developer site with UTM tracking on extension install.
• No CSP declared (csp_present=false); innerHTML sink in popup.js creates DOM-XSS exposure.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL -> gameograf.com with UTM params; monetization/tracking on removal.
• install_url_hijack manifest onInstalled opens gameograf.com with UTM params; traffic-monetization shell indicator.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; replaces all new tab pages for 732 users.
• no_csp crx content_security_policy is null; MV3 default applies but no explicit hardening.
• dom_xss_sink crx innerHTML from variable in js/popup.js with no CSP; DOM-XSS risk elevated.
• verified_publisher store Verified publisher badge present; caps but months_since_update=15 limits discount (0c).
• maintenance_stale store 15 months since last update; falls in 12-24mo band (+6.0 base).
• privacy_policy_adequate api Policy fetched; scope_extension, data_collection, retention, third_party_sharing all true. Score +0.0 base +0.0 silence.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — (G)I-Dle Gidle Live Wallpaper New Tab [adware] + malext.io malicious_extension_sentry; score 4.14 -> 6.64 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Grants access to search provider; expected for NewTab but enables search interception.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain only.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary function but enables monetization injection.

Pillar Scores

Bookkeeping