Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Treehouse Summer Rain Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override replaces every new tab — high-reach monetization surface with install+uninstall URL hijacks.
• Privacy policy URL returns connection error (fetch_error); policy effectively unavailable — scored as no policy.
• Install and uninstall URL hijacks redirect to gameograf.com with UTM tracking on every install/uninstall.
• Two unguarded innerHTML DOM-XSS sinks (popup.js, calendar.js) with no CSP to mitigate.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html — replaces every new tab for all users.
• install_uninstall_url_hijack manifest Both onInstalled and uninstall URLs point to gameograf.com with UTM tracking params.
• privacy_policy_fetch_error api privacy_policy_classification.fetched=false (ConnectionError); policy scored as unavailable.
• dom_xss_sink crx innerHTML assigned from variable in popup.js and calendar.js; no CSP present (MV3 default only).
• no_csp_declared manifest content_security_policy is null; no explicit CSP hardening beyond MV3 defaults.
• developer_name_missing store developer_name is empty string; no 'Offered by' identity visible to users.
• verified_publisher store verified_publisher=true; partially mitigates reputation risk but does not resolve privacy gap.
• new_tab_search_engine_single api search_engine_count=1 (google.com); no multi-search-engine aggregator penalty applies.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Treehouse Summer Rain Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.36 -> 7.86 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding or reading search provider; medium risk for a NewTab extension.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; expected for live wallpaper config fetches.
• chrome_url_overrides.newtab medium Replaces new-tab page — primary monetization surface for this extension type.

Pillar Scores

Bookkeeping