Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Ori Winter Tree 4K Live Wallpaper Gameograf [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy URL returns HTTP error — treated as no policy; score 10.0 on privacy pillar.
• NewTab override replaces every new tab with wallpaper/search monetization surface.
• Uninstall and install URL hijacks to gameograf.com track user lifecycle events.
• Two innerHTML-from-variable DOM-XSS sinks with no CSP present (MV3 no explicit CSP).

Evidence

• privacy_policy_unfetchable api fetch_error:HTTPError on https://gameograf.com/privacy-policy/ — treated as no policy per v3 Privacy pillar.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; every new tab replaced by this extension.
• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?utm_source=gameograf&utm_medium=link&utm_campaign=bg&utm_content=uninstall
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install&utm_medium=link&utm_campaign=bg&utm_content=install
• dom_xss_sink_no_csp crx Two innerHTML-from-variable sinks in popup.js and calendar.js; csp_present=false.
• verified_publisher store Verified publisher badge present; domain resolves; domain age ~2050 days. Discount applied but capped.
• new_tab_search_monetization store NewTab category + search permission + install/uninstall URL tracking = monetization shell pattern.
• no_developer_name store developer_name is empty string; slight reputation penalty applied.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Ori Winter Tree 4K Live Wallpaper Gameograf [adware] + malext.io malicious_extension_sentry; score 4.64 -> 7.14 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying default search engine; common in NewTab overrides but can monetize searches.
• host_permission: https://api.gameograf.com/* low Scoped to own API domain; low blast radius.
• chrome_url_overrides.newtab medium Replaces every new tab; high reach, search-monetization vector.

Pillar Scores

Bookkeeping