Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Sakura Car Scene Live Wallpaper - New Tab Theme [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• New-tab override captures every new tab; combined with uninstall/install URL hijack to gameograf.com for monetization tracking.
• Both install and uninstall URL hijack fire redirect to gameograf.com — traffic monetization pattern.
• No CSP on MV3 extension with innerHTML DOM sinks in popup.js and calendar.js — DOM-XSS risk elevated.
• Developer name field empty; reduces accountability signal despite verified publisher badge.

Evidence

• uninstall_url_hijack + install_url_hijack manifest Both onInstalled and setUninstallURL point to gameograf.com UTM-tagged URL — monetization redirect pattern.
• chrome_url_overrides.newtab manifest New-tab override declared; every new tab controlled by extension.
• no CSP (csp_present=false, MV3) manifest MV3 but no explicit content_security_policy; amplifies innerHTML XSS findings.
• dom_sink_innerhtml_userctrl x2 crx innerHTML sinks in popup.js and calendar.js without CSP; DOM-XSS surface.
• verified_publisher=true, developer_name empty store Verified publisher reduces reputation risk but missing developer name reduces accountability.
• privacy_policy fetched, scoped, discloses third-party sharing api Policy covers extension data collection, retention, and third-party sharing — adequate.
• operator_cluster sibling_count=0 api No sibling extensions detected under same fingerprint; no cluster amplifier.
• threat_intel clean api No bad-host, monetization, or affiliate hits; domain resolves, not throwaway.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Sakura Car Scene Live Wallpaper - New Tab Theme [adware] + malext.io malicious_extension_sentry; score 3.06 -> 5.56 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/modifying search provider; relevant for NewTab but adds override surface.
• host_permissions: https://api.gameograf.com/* low Scoped to dev-controlled API domain only; consistent with NewTab wallpaper function.
• chrome_url_overrides: newtab medium New-tab override captures every new tab opened; primary monetization surface for this category.

Pillar Scores

Bookkeeping