Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Scary Shark Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override monetization shell: replaces every new tab, installs+uninstall URL hijacks to gameograf.com with UTM tracking.
• Privacy policy fetch failed (SSL error) — policy is effectively absent; privacy pillar scores maximum.
• Uninstall and install URL hijacks redirect to developer domain with marketing UTM params.
• No developer name provided; low-install (43) new-tab extension with commercial monetization fingerprint.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html — replaces every new tab page for all users.
• uninstall_url_hijack crx setUninstallURL target: https://gameograf.com/?utm_source=extension&utm_medium=install
• install_url_hijack crx onInstalled opens: https://gameograf.com/?utm_source=extension&utm_medium=install
• privacy_policy_fetch_failed api SSLError fetching https://api.gameograf.com/gameograf-privacy-policy.html — policy unverifiable.
• no_developer_name store developer_name is empty string; accountability gap.
• verified_publisher store Extension carries verified_publisher=true from Chrome Web Store.
• no_csp manifest content_security_policy is null on MV3 extension; no explicit CSP hardening.
• js_files_not_scanned crx js_files_scanned=0; code_findings_raw=[]; code quality unverifiable — treat as missing.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Scary Shark Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.30 -> 7.80 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Can interact with search; combined with newtab override raises monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab page — primary vector for search hijacking and ad monetization.
• host_permissions: https://api.gameograf.com/* medium Scoped to developer API; limited blast radius but unverifiable server-side behavior.

Pillar Scores

Bookkeeping