Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Squid Game Netflix Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override replaces every new tab with developer-controlled page; monetization/redirect risk.
• Privacy policy is Google's own generic policy — not scoped to this extension; data_collection+third_party_sharing admitted.
• Netflix brand impersonation by unverified developer (gameograf.com); no confirmed ownership.
• Uninstall and install URL hijacks redirect users to developer marketing site via bit.ly affiliate link.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html; replaces every new tab for all users.
• brand_impersonation store brand_mention: netflix mentioned, confirmed_owner=false, is_impersonation=true.
• generic_privacy_policy store Privacy URL is Google's own policy (myaccount.google.com/privacypolicy); scope_extension=false, data_collection=true, third_party_sharing=true.
• uninstall_url_hijack crx setUninstallURL -> https://gameograf.com/?utm_source=gameograf via tracking params.
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install via tracking params.
• affiliate_hit crx js_external_hosts includes bit.ly — affiliate/cloaking short-link redirector.
• stale_extension store 16 months since last update; NewTab override remains active with no maintenance.
• no_developer_name store developer_name is empty string; verified_publisher=true but no display name.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Squid Game Netflix Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.32 -> 6.82 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows search provider interaction; paired with newtab override gives monetization capability.
• chrome_url_overrides.newtab high Replaces every new tab — high reach, monetization/redirect surface.

Pillar Scores

Bookkeeping