Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Cute Crab Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override with uninstall/install URL hijack to gameograf.com — traffic monetization pattern.
• No CSP declared (MV3 default applies but csp_present=false); innerHTML sinks elevate DOM-XSS risk.
• Unverified developer with 27 installs overrides new tab — low accountability, high reach per-user.
• Privacy policy admits data collection and third-party sharing; adequacy depends on scope accuracy.

Evidence

• newtab_override manifest chrome_url_overrides.newtab=newtab.html — replaces every new tab for all users.
• uninstall_url_hijack crx setUninstallURL to https://gameograf.com/?utm_source=extension&utm_medium=install
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install
• dom_xss_sinks crx innerHTML assignments in popup.js and calendar.js without CSP; DOM-XSS risk.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.
• privacy_policy_third_party api Policy admits data collection + third-party sharing; scope_extension=true, retention=true.
• unverified_developer_low_installs store verified_publisher=false, is_featured=false, 27 installs — minimal external accountability.
• search_engine_count_1 api Only google.com seen; no multi-search-engine ad aggregation detected.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Cute Crab Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 2.92 -> 5.42 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding or querying search provider; medium risk for a NewTab extension.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces new tab page; persistent high-reach surface on every new tab open.

Pillar Scores

Bookkeeping