Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — ENHYPEN Current Wallpapers New Tab by Gameograf [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Google's own privacy policy used as extension policy — admits data collection & 3rd-party sharing, not scoped to this extension (+10 privacy).
• NewTab override replaces every new tab with monetization-shaped fan-theme page; uninstall URL hijack to gameograf.com.
• 9 moderate CVEs across jquery@1.9.1, jquery@3.4.1, jquery-ui@1.12.1 — all below fixed versions; XSS risk on new-tab surface.
• 12 external JS hosts contacted (facebook, whatsapp, pinterest, twitter, crazycraftz.com etc.) from new-tab page.

Evidence

• privacy_policy_generic_google store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• newtab_override manifest chrome_url_overrides.newtab=index.html replaces every new tab; core monetization surface for fan-theme shell.
• uninstall_url_hijack crx setUninstallURL points to gameograf.com UTM-tracked page; monetization signal.
• cve_moderate_x9 crx jquery@1.9.1 (3 CVEs), jquery@3.4.1 (2 CVEs), jquery-ui@1.12.1 (4 CVEs) — all moderate severity, all below fixed versions.
• external_js_hosts crx 12 distinct external JS hosts including api.whatsapp.com, pinterest.com, www.crazycraftz.com, facebook.com, twitter.com.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit restriction, combined with multiple CVEs in DOM libs.
• developer_name_missing store developer_name is empty string; reduces accountability despite verified_publisher=true.
• stale_18mo store months_since_update=18; at boundary of 6.0 maintenance score; CVE-laden libs not updated.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — ENHYPEN Current Wallpapers New Tab by Gameograf [adware] + malext.io malicious_extension_sentry; score 4.71 -> 7.21 (+2.5 cap 2.5).

CVE Exposures (9)

Permissions Breakdown

• search medium Can intercept or manipulate search queries; elevated in NewTab context.
• topSites medium Reads user's most-visited sites; privacy exposure.
• unlimitedStorage low Allows unbounded local storage; low direct harm.
• storage low Standard key-value storage; low risk alone.
• chrome_url_overrides.newtab high Replaces every new tab; persistent reach over all browsing sessions.

Pillar Scores

Bookkeeping