Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — G)I-DLE (여자)아이들 Wallpapers New Tab Extension by Gameograf [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• 9 medium-severity CVEs across bundled jquery@1.9.1, jquery@3.4.1, jquery-ui@1.12.1 — all below fixed versions; no CSP amplifies XSS risk.
• NewTab override replaces every new tab page; uninstall URL hijack redirects to gameograf.com ad tracking endpoint.
• Install URL hijack opens index.html on install; combined with newtab override creates persistent monetization surface.
• No CSP (csp_present=false) combined with vulnerable jQuery libs increases XSS exploitability in new-tab context.

Evidence

• newtab_override manifest chrome_url_overrides.newtab=index.html replaces every new tab; high reach for 234 installs.
• uninstall_url_hijack crx setUninstallURL to gameograf.com with UTM tracking params — monetization signal.
• cve_bundled_libs crx 9 medium CVEs: jquery-ui@1.12.1 (4 XSS), jquery@3.4.1 (2 XSS), jquery@1.9.1 (3 XSS) all unfixed.
• no_csp manifest content_security_policy is null; MV3 but no explicit CSP declared, amplifying CVE XSS risk.
• stale_extension store Last updated March 27, 2025; months_since_update=18 with outstanding CVEs.
• verified_publisher_capped store verified_publisher=true but months_since_update=18 triggers 0c cap; discount limited to -1.0.
• external_hosts_broad crx 12 external JS hosts including api.whatsapp.com, pinterest.com, crazycraftz.com — >3 distinct domains.
• privacy_policy_adequate api Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — G)I-DLE (여자)아이들 Wallpapers New Tab Extension by Gameograf [adware] + malext.io malicious_extension_sentry; score 4.74 -> 7.24 (+2.5 cap 2.5).

CVE Exposures (9)

Permissions Breakdown

• search medium Can read search queries and provider; elevated for NewTab category.
• topSites medium Reveals user's most-visited sites; privacy risk in a NewTab shell.
• unlimitedStorage low Allows storing large data; low risk alone.
• storage low Standard local/sync storage; low risk alone.
• chrome_url_overrides.newtab medium Replaces every new tab; high reach, monetization attack surface.

Pillar Scores

Bookkeeping