Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Manchester United Wallpapers [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override + search permission replaces browser start page and search provider daily for all users.
• Uninstall URL hijack redirects users to gameograf.com on removal — monetization/tracking signal.
• Install URL hijack opens gameograf.com on installation — unsolicited redirect.
• bit.ly affiliate/cloaking link in js_external_hosts obscures final redirect destination.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces new-tab on every browser open.
• uninstall_url_hijack crx setUninstallURL → gameograf.com UTM-tagged; +3.0 Webstore rule triggered.
• install_url_hijack crx onInstalled opens gameograf.com UTM-tagged URL; +2.0 Webstore rule triggered.
• affiliate_hit_bitly crx bit.ly in js_external_hosts; affiliate/cloaking redirector — exactly 1 domain → +1.5 Webstore.
• no_csp manifest content_security_policy is null; csp_present=false for MV3 extension.
• dom_xss_sink crx dom_sink_innerhtml_userctrl in popup.js; no CSP present → escalated to +2.0 code quality.
• maintenance_stale store months_since_update=16; 12–24mo bracket → +6.0 maintenance base.
• verified_publisher store verified_publisher=true but months_since_update=16 (>14mo cap zone); discount limited by v3.5 invariant 0c check.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Manchester United Wallpapers [adware] + malext.io malicious_extension_sentry; score 4.47 -> 6.97 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Can manipulate default search provider; typical NewTab monetization vector.
• chrome_url_overrides.newtab medium Replaces new-tab page with extension-controlled HTML; high-reach daily exposure.
• host_permissions: https://api.gameograf.com/* low Scoped to dev-controlled API; limited blast radius.

Pillar Scores

Bookkeeping