Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Ford Mustang Red City Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy — not scoped to this extension, yet admits data collection and third-party sharing (+10 privacy pillar).
• New-tab override combined with 'search' permission is a classic monetization/search-hijack shell pattern.
• Uninstall and install URL hijacks redirect users to gameograf.com tracking URLs — active engagement/monetization.
• Two innerHTML DOM-XSS sinks (popup.js, calendar.js) with no CSP in MV3 extension elevate code quality risk.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces every new tab for all users.
• uninstall_url_hijack crx setUninstallURL targets https://gameograf.com/?utm_source=gameograf&utm_medium=link&utm_campaign=bg&utm_content=uninstall
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install&utm_medium=link&utm_campaign=bg&utm_content=install
• generic_privacy_policy store Privacy policy URL is Google's account policy — scope_extension=false, data_collection=true, third_party_sharing=true.
• dom_xss_sink crx innerHTML used with user-controlled variable in js/popup.js and js/calendar.js; no CSP present.
• no_developer_name store developer_name is empty string; reduced accountability despite verified_publisher=true.
• verified_publisher store verified_publisher=true on gameograf.com which resolves and is not throwaway — partial reputation credit.
• search_permission_newtab manifest Combination of 'search' permission + newtab override on a wallpaper extension is a monetization-shell pattern.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Ford Mustang Red City Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.31 -> 7.81 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Grants ability to query and interact with browser search engine; combined with newtab override raises monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; low blast radius.
• chrome_url_overrides.newtab medium Replaces every new tab — high reach, common monetization vector for wallpaper/NewTab shells.

Pillar Scores

Bookkeeping