Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Cherry blossom meadow spring breeze live wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy URL is unreachable (fetch error) — treated as no policy, score 10.0.
• Uninstall and install URL hijack both fire to gameograf.com UTM-tracked URL — monetization shell pattern.
• NewTab override replaces every new-tab with developer-controlled page, very high daily reach.
• No content_security_policy on MV3 extension with DOM-XSS sinks (innerHTML) in popup.js and calendar.js.

Evidence

• uninstall_url_hijack + install_url_hijack manifest Both onInstalled and uninstall redirect to https://gameograf.com/?utm_source=dekuy&utm_medium=dekuy — monetization shell.
• chrome_url_overrides.newtab manifest newtab.html overrides every new-tab page; high-reach daily surface for traffic monetization.
• privacy_policy_unreachable api privacy_policy_classification.fetched=false (ConnectionError) — policy scored as absent.
• dom_sink_innerhtml_userctrl crx innerHTML assigned from variable in js/popup.js and js/calendar.js — DOM-XSS sinks with no CSP.
• no_csp manifest content_security_policy is null; DOM-XSS sinks present with no mitigating CSP header.
• developer_identity_mismatch store developer_name=Dekuy.com, developer_email=support@gameograf.com — two different domains, no verified publisher.
• newtab_webstore_monetization store NewTab category + install/uninstall URL hijack to UTM-tracked domain = traffic-monetization fingerprint.
• js_external_hosts_broad crx 12 external JS hosts including api.gameograf.com and multiple Google services contacted by extension JS.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Cherry blossom meadow spring breeze live wallpaper [adware] + malext.io malicious_extension_sentry; score 5.24 -> 7.74 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading and potentially overriding search provider; pairs with newtab override.
• host_permissions: https://api.gameograf.com/* medium Scoped to developer domain; enables outbound API calls from extension.
• chrome_url_overrides: newtab medium Replaces new-tab page — high-reach surface with monetization potential.

Pillar Scores

Bookkeeping