Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Choso Crimson Threads Jujutsu Kaisen Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy — scope_extension=false, data_collection=true, third_party_sharing=true; admits data sharing with no extension-specific scope.
• NewTab override + search permission = monetization shell; uninstall and install URL hijacks confirmed targeting gameograf.com with UTM tracking.
• dev_email cluster: 42 siblings share same email, 25 share uninstall URL — mass wallpaper farm pattern.
• Two innerHTML DOM-XSS sinks with no CSP (MV3 but csp_present=false) — XSS risk on new-tab page content.

Evidence

• newtab_override_with_monetization manifest chrome_url_overrides.newtab set; uninstall_url and install_url both hijack to gameograf.com with UTM params.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — not scoped to this extension; data_collection+third_party_sharing=true.
• operator_cluster_large_email_set api support@gameograf.com shared by 42 extensions; 25 share same uninstall URL — wallpaper farm operator.
• dom_xss_no_csp crx innerHTML sinks in popup.js and calendar.js; csp_present=false on MV3 extension.
• uninstall_url_hijack crx runtime.setUninstallURL → gameograf.com with utm_campaign=bg, utm_content=uninstall.
• install_url_hijack crx onInstalled opens stranger-things-5 page on gameograf.com — cross-promotion on install.
• no_developer_name store developer_name is empty string despite verified_publisher=true.
• search_permission_newtab manifest 'search' permission + newtab override; search_engine_count=1 (google.com) — search monetization pattern.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Choso Crimson Threads Jujutsu Kaisen Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.84 -> 7.34 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/modifying search provider; paired with newtab override raises monetization risk.
• host_permission: https://api.gameograf.com/* low Scoped to dev's own API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces new-tab page — primary monetization/data-collection surface for this category.

Pillar Scores

Bookkeeping