Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Hong Kong Burnout Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy URL returns fetch error — effectively no accessible policy (pillar scored 10).
• Uninstall and install URL hijack to gameograf.com monetization tracking URL.
• NewTab override with search permission is a monetization shell pattern.
• Two innerHTML DOM-XSS sinks with no CSP elevate code quality risk.

Evidence

• privacy_policy_fetch_error api Privacy policy at api.gameograf.com returned ConnectionError; treated as fetched==false → score 10.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL points to gameograf.com UTM tracking URL — Webstore +3.0.
• install_url_hijack crx onInstalled opens gameograf.com UTM tracking URL — Webstore +2.0.
• newtab_override manifest chrome_url_overrides.newtab set; combined with search permission raises monetization concern.
• dom_sink_innerhtml crx Two innerHTML-from-variable sinks in popup.js and calendar.js with csp_present==false → Code +2.0.
• no_csp manifest content_security_policy is null; MV3 has strict default but DOM sinks are riskier without explicit CSP.
• verified_publisher store Verified publisher badge present; gameograf.com resolves, age 2051 days — reputation discount applied.
• no_developer_name store developer_name is empty string; reputation +1.0 for missing Offered-by identity.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Hong Kong Burnout Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.26 -> 7.76 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows search provider manipulation; paired with newtab override raises monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; acceptable for wallpaper/newtab content delivery.
• chrome_url_overrides.newtab medium NewTab override replaces browser new-tab; primary monetization surface for this extension.

Pillar Scores

Bookkeeping