Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Lofi Girl Nezuko Kamado Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• NewTab override + uninstall/install URL hijacks signal traffic-monetization shell pattern.
• dev_email dimension has 8 sibling extensions under same operator — high-volume factory pattern.
• No developer name listed; no 'Offered by' accountability signal.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html — intercepts every new-tab open.
• install_url_hijack manifest onInstalled opens https://gameograf.com/?utm_source=lofi&utm_medium=install.
• uninstall_url_hijack manifest setUninstallURL points to https://gameograf.com/?utm_source=extension&utm_medium=install.
• generic_privacy_policy store PP URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• operator_cluster api dev_email dimension shows 8 sibling extensions under support@gameograf.com.
• dom_xss_no_csp crx 2x dom_sink_innerhtml_userctrl findings; csp_present=false amplifies XSS surface.
• no_developer_name store developer_name is empty string — no accountability signal in store listing.
• verified_publisher store verified_publisher=true; partial reputation credit, but PP failure limits discount.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Lofi Girl Nezuko Kamado Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.74 -> 7.24 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/modifying search queries; medium risk for a NewTab override extension.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; low blast radius.
• chrome_url_overrides.newtab medium Replaces new-tab page; high-traffic intercept surface, monetization vector.

Pillar Scores

Operator Siblings (2)

Other extensions sharing this developer's compound fingerprint:

• npofmnnbidppdfjnfdcjicgmhhmahepm
• jkemcicifmakgecjlccgacekblpemlgc

Bookkeeping