Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Momo Ayase Dan Da Dan Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and third-party sharing (v3.5-D: +10.0 privacy).
• NewTab override + uninstall/install URL hijacks to gameograf.com indicate monetization shell pattern.
• Privacy policy URL is a generic Google policy (scope_extension=false, data_collection=true, third_party_sharing=true) — worst-case privacy posture.
• Maintenance stale at 15 months; verified-publisher discount capped at -1.0 per 0c (stale >18mo does not apply here, but policy is generic Google).

Evidence

• privacy_policy_generic_google store Privacy policy URL points to myaccount.google.com — Google's own policy, not scoped to this extension; data_collection=true, third_party_sharing=true.
• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — controls every new tab page.
• uninstall_url_hijack crx setUninstallURL targets gameograf.com with UTM params — monetization shell signal.
• install_url_hijack crx onInstalled opens gameograf.com with UTM params — install-time redirect.
• no_csp manifest content_security_policy is null; MV3 default applies but dom_sink_innerhtml_userctrl present increases XSS risk.
• dom_sink_innerhtml_userctrl crx js/popup.js assigns user-controlled variable to innerHTML without sanitization — DOM-XSS sink.
• verified_publisher store verified_publisher=true for info@gameograf.com; provides limited trust mitigation.
• months_since_update_15 store Last updated June 2025; 15 months stale — maintenance score elevated (+6.0).
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Momo Ayase Dan Da Dan Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.41 -> 7.91 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying browser search settings; medium risk paired with newtab override.
• host_permissions: https://api.gameograf.com/* low Scoped to dev-controlled API domain only; limited blast radius.
• chrome_url_overrides.newtab medium Replaces every new tab; primary monetization/search-hijack vector for this category.

Pillar Scores

Bookkeeping