Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Witch Hat Atelier Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy URL fetch failed — no effective privacy disclosure; scored as no policy (+10.0).
• NewTab override + search permission = monetization/redirect surface on every new tab.
• Uninstall and install URL hijacking to gameograf.com affiliate UTM parameters.
• Two innerHTML DOM-XSS sinks with no CSP, elevating exploitability of any injected content.

Evidence

• privacy_policy_fetch_failed api Privacy policy at api.gameograf.com returned HTTPError; treated as no policy (Privacy +10.0).
• newtab_override manifest chrome_url_overrides.newtab set to newtab.html; replaces every new tab for all 89 installs.
• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?utm_source=extension&utm_medium=install (Webstore +3.0).
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install (Webstore +2.0).
• dom_xss_no_csp crx Two innerHTML sinks in popup.js and calendar.js; csp_present==false elevates each to +2.0 each.
• no_developer_name store developer_name is empty string; Reputation +1.0 (no Offered By).
• verified_publisher store verified_publisher==true; Reputation -3.0 discount applied (not capped by 0c — no stale/CVE/unresolved).
• search_engine_count api search_engine_count==1 (google.com only); no multi-search-engine NewTab anomaly triggered.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Witch Hat Atelier Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.87 -> 7.37 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/modifying search provider; paired with newtab override raises monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to dev's own API domain; expected for a live wallpaper fetching assets.
• chrome_url_overrides: newtab medium Replaces every new tab page — high reach, monetization vector, scored per rubric (a).

Pillar Scores

Bookkeeping