Netskope Extension Risk

Detail view · rubric v3.6
← Back to catalog

Counter-Strike 2 CS:GO2 Wallpapers Gameograf

enifepnibolbognbdpplhhigkmeenipp
Risk Score
6.96
Risk Level: High
Recommendation: 🟠 HIGH RISK — review
Category NewTab
Installs 419
Rating 5.0
Last updated 2024-09-18 (24 months ago)
Manifest version MV3
CSP present ❌ no
Developer info@gameograf.com
Verified publisher ✅ yes
Featured by Google ❌ no
Privacy policy link
Web Store open ↗

Top Risks

  • THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Counter-Strike 2 CS:GO2 Wallpapers Gameograf [adware] + malext.io malicious_extension_sentry (+2.5, capped).
  • New-tab override replaces every new tab; uninstall URL hijack redirects to developer site on removal.
  • Privacy policy URL returns fetch error — effectively no accessible privacy policy (score: 10.0).
  • 9 medium-severity CVEs across bundled jquery@1.9.1, jquery@3.4.1, and jquery-ui@1.12.1 — all unpatched.
  • No CSP declared (MV3 default applies) combined with vulnerable jQuery/jQuery-UI XSS libs in newtab context.

Evidence

  • newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab for all users.
  • uninstall_url_hijack crx setUninstallURL targets https://gameograf.com/counter-strike-csgo-chrome-newtab-wallpaper/ (3rd-party redirect).
  • install_url_hijack crx onInstalled opens index.html; low risk but confirms hijack pattern.
  • privacy_policy_fetch_failed api privacy_policy_classification.fetched=false, reason=fetch_error:HTTPError. Treated as no accessible policy.
  • cve_medium_x9 crx 9 moderate CVEs in jquery@1.9.1, jquery@3.4.1, jquery-ui@1.12.1; none patched to fixed_in versions.
  • no_csp manifest content_security_policy is null; csp_present=false. XSS-prone jQuery libs run without CSP guard.
  • stale_extension store Last updated September 18, 2024; months_since_update=24. Maintenance score = 6.0.
  • no_developer_name store developer_name is empty string; reduces accountability despite verified_publisher=true.
  • threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Counter-Strike 2 CS:GO2 Wallpapers Gameograf [adware] + malext.io malicious_extension_sentry; score 4.46 -> 6.96 (+2.5 cap 2.5).

CVE Exposures (9)

CVELibrarySeverity Fixed inSummary
CVE-2021-41182 jquery-ui@1.12.1 moderate 1.13.0 XSS in the `altField` option of the Datepicker widget in jquery-ui
CVE-2021-41184 jquery-ui@1.12.1 moderate 1.13.0 XSS in the `of` option of the `.position()` util in jquery-ui
CVE-2022-31160 jquery-ui@1.12.1 moderate 1.13.2 jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like in
CVE-2021-41183 jquery-ui@1.12.1 moderate 1.13.0 XSS in `*Text` options of the Datepicker widget in jquery-ui
CVE-2020-11022 jquery@3.4.1 moderate 3.5.0 Potential XSS vulnerability in jQuery
CVE-2020-11023 jquery@3.4.1 moderate 3.5.0 Potential XSS vulnerability in jQuery
CVE-2019-11358 jquery@1.9.1 moderate 3.4.0 XSS in jQuery as used in Drupal, Backdrop CMS, and other products
CVE-2020-11023 jquery@1.9.1 moderate 3.5.0 Potential XSS vulnerability in jQuery
CVE-2015-9251 jquery@1.9.1 moderate 1.12.2 Cross-Site Scripting (XSS) in jquery

Permissions Breakdown

  • topSites medium Reads user's most visited sites; mild privacy exposure for a NewTab extension.
  • unlimitedStorage low Allows large local storage; low direct risk.
  • storage low Standard key-value storage; low risk.
  • chrome_url_overrides.newtab medium Replaces new-tab page; primary monetization surface for this extension type.

Pillar Scores

Permissions3.80
Reputation3.50
Network2.00
Webstore8.50
Maintenance6.00
Privacy10.00
Code Quality0.00
CVE Exposure5.00

Bookkeeping

Rubric v3.6
Scored at 2026-11-03 09:52
Listing SHA f7fc1190a3a4…
Force block — not fired
Score recovered no
Elapsed —