Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Cute Cat Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override with search permission = confirmed monetization shell; every new tab is captured.
• Privacy policy URL fetch failed (ConnectionError) — policy cannot be validated; treated as no policy.
• Uninstall + install URL hijack both redirect to gameograf.com UTM-tracked landing page.
• No developer name listed; no CSP present on MV3 extension with innerHTML DOM-XSS sinks.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — captures every new tab opened by user.
• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?utm_source=extension&utm_medium=install
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install
• privacy_policy_fetch_failed api fetch_error:ConnectionError on https://api.gameograf.com/gameograf-privacy-policy.html → scored as no policy.
• dom_xss_sink crx innerHTML assigned from variable in popup.js and calendar.js; no CSP to mitigate.
• no_developer_name store developer_name is empty string; reduces accountability.
• newtab_monetization_search manifest search permission + newtab override = classic search-monetization pattern.
• verified_publisher store Verified publisher badge present; partial reputation credit applied.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Cute Cat Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.42 -> 7.92 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying browser search; paired with newtab override indicates search monetization intent.
• chrome_url_overrides.newtab high Replaces every new tab — high reach, primary monetization surface for this category.
• host_permissions: https://api.gameograf.com/* medium Scoped to dev domain only; but privacy policy URL is unreachable at this host.

Pillar Scores

Bookkeeping