Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Topo Screensaver Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override replaces every new tab — high-reach monetization/tracking surface with 'search' permission.
• Uninstall and install URL hijacks redirect to gameograf.com with UTM tracking params.
• No CSP (csp_present=false) amplifies DOM-XSS risk from innerHTML sinks in popup.js and calendar.js.
• Missing developer name reduces accountability; screensaver category masks search/newtab monetization shape.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html — replaces every new tab page.
• uninstall_url_hijack crx setUninstallURL targets https://gameograf.com/?utm_source=extension&utm_medium=install
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension with DOM sinks.
• dom_xss_sinks crx innerHTML assignments from variables in popup.js and calendar.js without CSP guard.
• broad_js_external_hosts crx 12 external hosts including mail.google.com, drive.google.com, docs.google.com beyond screensaver scope.
• no_developer_name store developer_name is empty string — no 'Offered by' identity visible to users.
• verified_publisher store verified_publisher=true; discount applied but capped due to newtab+monetization shape.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Topo Screensaver Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.16 -> 6.66 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying browser search engine; paired with newtab override raises monetization concern.
• https://api.gameograf.com/* low Scoped host permission to developer's own API domain only.
• chrome_url_overrides.newtab medium Replaces every new tab — high-reach surface for monetization or tracking.

Pillar Scores

Bookkeeping