Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — infinite-drift in snow [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall and install URL hijack redirect to gameograf.com with UTM tracking — confirmed monetization shell pattern.
• Privacy policy URL returned SSLError (unfetchable); treated as no policy — maximum privacy score.
• NewTab override replaces every new tab, giving permanent control over user start-page and search behavior.
• Developer name (Dekuy.com) mismatches email domain (gameograf.com) — identity inconsistency.

Evidence

• install_url_hijack manifest onInstalled opens https://gameograf.com/?utm_source=dekuy&utm_medium=dekuy — install redirect to 3rd-party UTM URL.
• uninstall_url_hijack manifest setUninstallURL targets https://gameograf.com/?utm_source=dekuy&utm_medium=dekuy — uninstall redirect to 3rd-party UTM URL.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html — replaces every new tab page.
• privacy_policy_unfetchable api Fetch of privacy policy URL failed with SSLError; policy content cannot be verified — scored as no policy.
• developer_identity_mismatch store Developer name is Dekuy.com but email domain is gameograf.com; UTM also references dekuy — split-brand shell.
• no_verified_publisher store Neither verified publisher nor Google featured badge; 9 installs, 0 ratings — no accountability signals.
• js_external_hosts crx 12 external JS hosts including Google services and gameograf.com; js_files_scanned=0 so code not verified.
• csp_absent manifest content_security_policy is null (MV3 default CSP applies); no explicit hardening declared.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — infinite-drift in snow [adware] + malext.io malicious_extension_sentry; score 5.29 -> 7.79 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/manipulating search queries; pairs with newtab override for search monetization.
• host_permission: https://api.gameograf.com/* medium Scoped to dev domain only; used for newtab content/config delivery.
• chrome_url_overrides.newtab medium Replaces new tab page — prime monetization surface; intercepts every new tab action.

Pillar Scores

Bookkeeping