Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Anime Girl and Sportcar Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy URL fetch failed — treated as no policy; no data handling transparency.
• NewTab override with uninstall URL hijack and install URL hijack — classic monetization shell pattern.
• dev_email dimension shows 9 siblings under same email — operator runs multiple wallpaper/newtab shells.
• DOM-XSS sinks (innerHTML) without CSP in MV3 newtab context elevate injection risk.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — high-reach search/monetization surface.
• uninstall_url_hijack crx setUninstallURL targets gameograf.com with UTM tracking params.
• install_url_hijack crx onInstalled opens gameograf.com with UTM install tracking params.
• privacy_policy_fetch_failed api privacy_policy_classification.fetched=false (HTTPError); scored as no policy (+10.0).
• operator_cluster_siblings api dev_email dimension: 9 siblings under info@gameograf.com — multi-extension shell operator.
• dom_xss_no_csp crx Two innerHTML sinks in popup.js and calendar.js; csp_present=false increases DOM-XSS risk.
• domain_age api gameograf.com first cert 2021-02-03, age_days=2050, cert_count=265 — established domain.
• maintenance_stale store months_since_update=12 (6-12mo band) → +3.5 maintenance score.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Anime Girl and Sportcar Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.99 -> 7.49 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows access to Chrome search API; combined with newtab override raises monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces new-tab page; high-reach surface for monetization and search hijack.

Pillar Scores

Operator Siblings (2)

Other extensions sharing this developer's compound fingerprint:

• bajfhkcgipciajpkdlkoefampepbmdom
• inofddlmllkdhdgchfekpjhnoondaenl

Bookkeeping