Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — KPop Demon Hunters – Saja Boys Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• New-tab override with uninstall URL hijack and install URL hijack — classic monetization shell pattern.
• Privacy policy is Google's generic policy (scope_extension=false, data_collection=true, third_party_sharing=true) — scores max privacy risk.
• No developer name listed; no verified publisher badge; generic identity signals.
• DOM-XSS sinks (innerHTML) present without CSP; MV3 but csp_present=false amplifies risk.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces every new tab with developer-controlled page.
• uninstall_url_hijack crx setUninstallURL points to gameograf.com with UTM tracking params — Webstore +3.0.
• install_url_hijack crx onInstalled opens gameograf.com with UTM install params — Webstore +2.0.
• generic_privacy_policy store Privacy policy is Google's own policy (myaccount.google.com); scope_extension=false, data_collection=true, third_party_sharing=true.
• no_developer_name store developer_name is empty string; no verified publisher; no featured badge — Reputation +1.0.
• dom_xss_no_csp crx Two innerHTML-from-variable sinks in popup.js and calendar.js with csp_present=false.
• search_permission_newtab manifest search permission + newtab override together enable search provider and new tab monetization.
• maintenance_stale store months_since_update=12; falls in 6-12mo band (+3.5).
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — KPop Demon Hunters – Saja Boys Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.32 -> 6.82 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding search provider; medium risk for search hijacking.
• host_permissions: https://api.gameograf.com/* low Scoped to dev's own API domain; limited reach.
• chrome_url_overrides.newtab medium Replaces new tab page; monetization and data collection vector.

Pillar Scores

Bookkeeping