Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Formula1 RedBull Car Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override monetizes every new-tab event with uninstall/install URL hijacks redirecting to developer site.
• Privacy policy not scoped to this extension and does not confirm data collection, scoring near-worst tier.
• Uninstall and install URL hijacks confirmed — classic low-effort traffic-monetization shell pattern.
• DOM-XSS sink (innerHTML with user-controlled variable) in calendar.js without CSP protection.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL targets gameograf.com with UTM tracking — confirmed traffic monetization.
• install_url_hijack manifest onInstalled opens gameograf.com with UTM tracking — confirmed install-event monetization.
• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — every new tab is controlled by extension.
• privacy_policy_not_scoped api Policy fetched but scope_extension=false and data_collection=false — generic, not extension-specific.
• dom_sink_innerhtml_userctrl crx js/calendar.js assigns user-controlled variable to innerHTML with no CSP — DOM-XSS risk.
• no_developer_name store developer_name is empty string; identity accountability reduced.
• search_permission_with_newtab manifest 'search' permission + NewTab override is a standard search-monetization shell fingerprint.
• csp_absent_mv3 manifest content_security_policy is null; MV3 default applies but no explicit policy hardens innerHTML sink.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Formula1 RedBull Car Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.43 -> 6.93 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/setting default search engine; relevant to NewTab monetization.
• alarms low Scheduled callbacks only; low standalone risk.
• storage low Local key-value storage; low risk.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; high monetization and tracking surface.
• host_permissions: https://api.gameograf.com/* medium Allows XHR to developer API; scoped to own domain but enables data exfil.

Pillar Scores

Bookkeeping