Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Bad Bunny Wallpapers [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy — admits data collection & 3rd-party sharing with no extension-specific scope.
• Uninstall and install URL hijack to gameograf.com — classic NewTab monetization shell pattern.
• NewTab override combined with search permission enables ad-monetization of every new tab.
• No CSP + innerHTML sink in popup.js creates DOM-XSS exposure.

Evidence

• uninstall_url_hijack + install_url_hijack manifest Both onInstall and onUninstall fire to gameograf.com UTM URLs — monetization shell fingerprint.
• newtab_override + search_permission manifest chrome_url_overrides.newtab + search permission = high-reach ad-monetization surface.
• generic_privacy_policy store Policy URL is Google Account privacy policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• dom_sink_innerhtml_userctrl crx innerHTML written from variable in popup.js; no CSP present to mitigate DOM-XSS.
• no_csp + dom_sink crx csp_present=false AND dom_sink finding active → dom_sink escalated to +2.0 code quality.
• no_developer_name store developer_name is empty string; +1.0 reputation penalty.
• verified_publisher store verified_publisher=true; -3.0 reputation applied but install+uninstall hijack indicate monetization shell.
• stale_extension store months_since_update=16; maintenance pillar +6.0 (6-12mo band just passed; 12-24 applies).
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Bad Bunny Wallpapers [adware] + malext.io malicious_extension_sentry; score 4.52 -> 7.02 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding search provider — monetization vector for NewTab category.
• host_permissions: https://api.gameograf.com/* low Scoped to developer-controlled API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces new-tab page — high-reach surface with monetization potential.

Pillar Scores

Bookkeeping