Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Pink Cute Lamb Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override replaces every new tab; monetization/search redirect surface with uninstall+install URL hijack.
• Uninstall and install URL hijack both redirect to gameograf.com marketing URL.
• No CSP declared (MV3 default applies but no explicit policy); innerHTML sinks present in popup.js and calendar.js.
• No verified publisher badge; small install base (172) with high-reach newtab override.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces every new tab page.
• uninstall_url_hijack crx setUninstallURL targets https://gameograf.com/?utm_source=extension&utm_medium=install
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install
• dom_sink_innerhtml_userctrl crx Two innerHTML sinks found in popup.js and calendar.js — DOM-XSS risk without CSP.
• no_verified_publisher store Developer Gameograf.com has no verified publisher badge and no featured badge.
• js_external_hosts crx 12 external JS hosts including api.gameograf.com, Google services, chat.openai.com.
• csp_absent manifest content_security_policy is null; no explicit CSP declared.
• privacy_policy_classification api Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true — adequate.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Pink Cute Lamb Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 3.10 -> 5.60 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows search provider interaction; medium risk for a NewTab override extension.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; acceptable for a wallpaper/newtab extension.
• chrome_url_overrides.newtab medium Replaces new-tab page; monetization surface, controls what user sees on every new tab.

Pillar Scores

Bookkeeping