Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Yae Miko Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall and install URL hijack both redirect to gameograf.com — clear monetization shell pattern.
• Privacy policy is Google's generic account policy (scope_extension=false, data_collection=true, third_party_sharing=true) — worst-case privacy signal.
• New-tab override combined with 'search' permission creates ad-monetization surface against every new tab.
• No developer name disclosed; extension contacts 6 external JS hosts (Instagram, Netflix, YouTube, X, Google, gameograf.com).

Evidence

• install_url_hijack + uninstall_url_hijack manifest Both on/off install events redirect to gameograf.com with UTM tracking — textbook monetization shell. +3.0+2.0 webstore.
• chrome_url_overrides.newtab manifest New-tab override present; triggers +2.0 webstore (newtab with monetization shape) and scored as MEDIUM permission.
• privacy_policy_generic_google store PP is Google account policy: fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (D clause).
• js_external_hosts crx 6 external hosts: gameograf.com, google.com, instagram.com, netflix.com, youtube.com, x.com — >3 distinct domains +1.5 network.
• no_developer_name store developer_name is empty string → +1.0 reputation (no 'Offered by').
• verified_publisher store Verified publisher badge present; -3.0 reputation, but capped at -1.0 per v3.5(E) due to monetization-adjacent activity.
• csp_absent_mv3 manifest csp_present=false on MV3; no CVEs so no v2(b) +2.0 network penalty, but no CSP noted.
• months_since_update_4 store 4 months since update → +1.5 maintenance (3-6 month band).
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Yae Miko Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.27 -> 7.77 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying browser search; combined with newtab override enables search monetization.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary monetization surface for this extension category.

Pillar Scores

Bookkeeping