Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Anime JDM Car Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override + search permission: classic ad-monetization shell; uninstall/install URL hijack to gameograf.com confirms monetization intent.
• Privacy policy is Google's generic policy (myaccount.google.com) — not scoped to this extension; admits data collection and 3rd-party sharing.
• Two innerHTML DOM-XSS sinks with no CSP; MV3 but csp_present==false amplifies DOM sink risk.
• No developer name listed; unverified publisher with low install count but persistent new-tab real estate.

Evidence

• newtab_override_monetization manifest chrome_url_overrides.newtab set + search permission + uninstall/install URL hijacks to gameograf.com tracking URLs.
• privacy_policy_generic_google store Policy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• dom_xss_no_csp crx 2x dom_sink_innerhtml_userctrl findings in popup.js and calendar.js; csp_present=false elevates each to +2.0.
• uninstall_url_hijack crx uninstall_url_hijack=true targeting https://gameograf.com/?utm_source=gameograf&utm_campaign=bg&utm_content=uninstall.
• install_url_hijack crx install_url_hijack=true targeting https://gameograf.com/?utm_source=install&utm_campaign=bg&utm_content=install.
• no_developer_name store developer_name is empty string; no verified publisher badge; unverified identity.
• newtab_monetization_webstore store NewTab override with monetization shape: +2.0 (newtab+monetization) + +2.0 (install hijack) + +2.0 (uninstall hijack) scored.
• jquery_3.7.1_no_cve crx jQuery 3.7.1 detected; cve_findings_raw empty — no CVE penalty applied.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Anime JDM Car Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.57 -> 7.07 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Can manipulate search provider; paired with newtab override amplifies search monetization risk.
• chrome_url_overrides.newtab high Replaces new-tab page — primary vector for ad monetization and search hijacking.
• https://api.gameograf.com/* medium Scoped host permission to developer API; allows data exfil to dev-controlled endpoint.

Pillar Scores

Bookkeeping