Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Genji Overwatch Game Live Wallpaper Background [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy URL returns fetch error — effectively no accessible privacy policy; scored as unfetched (+10.0 privacy).
• Uninstall and install URL hijacks both active — redirecting to gameograf.com UTM pages on every install/remove event.
• NewTab override replaces every new-tab page; developer_name is empty raising accountability concerns.
• Two innerHTML DOM-XSS sinks (popup.js, calendar.js) with no CSP present — elevated XSS risk.

Evidence

• privacy_policy_fetch_failed api privacy_policy_classification.fetched=false (HTTPError); scored as +10.0 privacy per v3 FIX A.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL points to https://gameograf.com/?utm_source=gameograf — +3.0 webstore.
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install — +2.0 webstore.
• newtab_override manifest chrome_url_overrides.newtab=newtab.html — +2.0 webstore (newtab override with monetization shape).
• dom_xss_no_csp crx Two innerHTML sinks in popup.js and calendar.js; csp_present=false triggers +2.0 code quality (FIX B).
• no_developer_name store developer_name is empty string — +1.0 reputation per no 'Offered by' / dev name rule.
• verified_publisher store verified_publisher=true; discount -3.0 reputation but capped at -1.0 under 0c (months_since_update=12, approaching 18mo boundary — applied full -3.0 as <18mo).
• maintenance_6_12mo store months_since_update=12; falls at 6-12mo boundary → +3.5 maintenance.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Genji Overwatch Game Live Wallpaper Background [adware] + malext.io malicious_extension_sentry; score 4.55 -> 7.05 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading and modifying search queries; medium risk on its own but paired with newtab override.
• host_permissions: https://api.gameograf.com/* low Scoped to own API domain only; limited surface area.
• chrome_url_overrides.newtab medium Replaces every new-tab page; monetization/data-collection vector on all new tabs.

Pillar Scores

Bookkeeping