Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Ferrari Koenigsegg Live Wallpaper 4K [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy URL fetch failed — treated as no policy; data handling completely unknown.
• Uninstall and install URL hijacks redirect to gameograf.com marketing pages — monetization shell pattern.
• NewTab override with 'search' permission and newtab.html — classic search-monetization vector.
• DOM-XSS sink (innerHTML) in calendar.js with no CSP present — exploitable if input is attacker-controlled.

Evidence

• privacy_policy_fetch_failed api privacy_policy_classification.fetched=false (HTTPError); scored as no policy → Privacy pillar +10.0
• uninstall_url_hijack crx chrome.runtime.setUninstallURL to gameograf.com marketing URL → Webstore +3.0
• install_url_hijack crx onInstalled opens gameograf.com marketing URL → Webstore +2.0
• newtab_override manifest chrome_url_overrides.newtab replaces every new tab; search permission present → Webstore +2.0
• dom_sink_innerhtml_userctrl crx innerHTML sink in calendar.js with csp_present=false → Code Quality +2.0 (FIX B)
• no_csp_mv3 manifest content_security_policy=null; MV3 has strict default but no explicit CSP declared.
• sibling_extensions_dev_email api operator_cluster.sibling_counts_by_dim.dev_email=9; same developer email on 9 other extensions.
• no_developer_name store developer_name is empty string; no 'Offered by' display name → Reputation +1.0
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Ferrari Koenigsegg Live Wallpaper 4K [adware] + malext.io malicious_extension_sentry; score 4.33 -> 6.83 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading search queries; combined with newtab override raises monetization risk.
• alarms low Scheduled callbacks; low standalone risk.
• storage low Local data storage; standard utility permission.
• chrome_url_overrides.newtab medium Replaces every new tab — high-reach surface for search/ad monetization.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.

Pillar Scores

Bookkeeping