Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Winx Club live wallpapers [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override by a factory operator (8 sibling extensions) — classic ad-monetization shell pattern.
• Privacy policy hosted on unrelated domain (haberikra.com), not scoped to this extension, admits data collection and third-party sharing.
• Uninstall and install URL hijacking to gameograf.com tracking endpoints — traffic monetization confirmed.
• Operator cluster of 23 dev-email siblings and 41 install-URL siblings indicates mass-production extension farm.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — hijacks every new tab for monetization.
• uninstall_url_hijack crx setUninstallURL to gameograf.com with UTM tracking params — 3rd-party traffic redirect on uninstall.
• install_url_hijack crx onInstalled opens gameograf.com with UTM params — 3rd-party redirect on install.
• operator_cluster api 8 compound siblings, 23 dev-email siblings, 41 install-URL siblings — extension factory pattern.
• privacy_policy_mismatch store Policy on haberikra.com (unrelated domain), admits data collection + 3rd-party sharing, not scoped to extension.
• maintenance_stale store 15 months since last update — falls in 12-24mo band (+6.0).
• dom_sink_innerhtml crx innerHTML assigned from variable in popup.js without CSP — DOM-XSS risk.
• verified_publisher_cap store Verified publisher discount capped at -1.0: months_since_update=15 (>12mo stale threshold applies).
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Winx Club live wallpapers [adware] + malext.io malicious_extension_sentry; score 6.28 -> 8.78 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying/overriding search; paired with newtab override raises monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab — primary surface for ad-monetization injection.
• host_permissions: https://api.gameograf.com/* low Scoped to developer-controlled domain; no broad host access.

Pillar Scores

Operator Siblings (13)

Other extensions sharing this developer's compound fingerprint:

• kenndofkbpgkfhaecjmnjmehhhbnioeh
• ieepfmpmjnjidennkopcbamjjdemhjcf
• chjbfnbpbgjnofhahgblpcifjcbkolcp
• bpicplogeibhabicoedobpchdkngbhjh
• jmokcnonladmkkdlgbalffkjiogfcgha
• aaobffjniaghknbgjdkigmcnapghemfa
• cfbobdhebljlbkhdhnikebhhijocphfo
• ckcailiifgopnblmaeaefimdgnaelcph
• hmagnnippelpfgkmbdnepolcgjlmbohh
• jimikjehahhdekhbmhpbmbponjcimajc
• jofgjibhmlaeofgmidllemkckkpgnpbd
• iimgbphfdpnahafdmikdjnpfnffnbkcl
• gafbkkfalgndkoilabfhmjjjgeihboed

Bookkeeping