Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Iron Man Marvel Rivals Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override combined with 'search' permission enables persistent search monetization/hijack on every new tab.
• Privacy policy is Google's own generic policy — not scoped to this extension; data_collection+third_party_sharing admitted.
• Uninstall URL hijack redirects to gameograf.com UTM link, confirming traffic-monetization shape.
• Install URL hijack opens gameograf.com on install — onInstalled 3rd-party URL pattern.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces every new tab for all users.
• uninstall_url_hijack crx setUninstallURL -> https://gameograf.com/?utm_source=gameograf&utm_medium=link&utm_campaign=bg&utm_content=uninstall
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install&utm_medium=link&utm_campaign=bg&utm_content=install
• generic_privacy_policy store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, scope_extension=false, data_collection=true.
• dom_xss_sink crx js/popup.js: innerHTML assigned from variable without sanitization; csp_present=false amplifies risk.
• no_developer_name store developer_name is empty string; only email info@gameograf.com provided.
• stale_extension store 15 months since last update — falls in 12-24mo band (+6.0 maintenance).
• verified_publisher_capped store Verified publisher but months_since_update=15 >12 months; 0c cap applies, discount capped at -1.0.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Iron Man Marvel Rivals Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.50 -> 7.00 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/manipulating search provider; paired with NewTab override amplifies monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to own API domain only; low inherent risk but enables data exfil to dev server.
• chrome_url_overrides.newtab medium Replaces new-tab page; high monetization surface, search hijack vector.

Pillar Scores

Bookkeeping