Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Abstract Live Wallpaper Chrome OS Theme [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override replaces every new-tab page; monetization/tracking risk on 100% of browsing sessions.
• Uninstall and install URL hijack both redirect to gameograf.com — tracking user lifecycle events.
• No CSP declared (MV3 with null CSP); DOM-XSS sinks in popup.js and calendar.js increase XSS risk.
• Developer name missing from listing; no 'Offered by' accountability signal.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces every new tab for all users.
• uninstall_url_hijack crx setUninstallURL targets https://gameograf.com/?utm_source=extension&utm_medium=install.
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install.
• no_csp manifest content_security_policy is null; MV3 default CSP applies but extension declares none explicitly.
• dom_xss_sinks crx Two innerHTML assignments from variables found in popup.js and calendar.js — DOM-XSS risk.
• external_host_breadth crx 12 external JS hosts including chat.openai.com, mail.google.com, ssl.gstatic.com — broad reach.
• verified_publisher store Developer has verified publisher badge; domain gameograf.com resolves and is not throwaway.
• no_developer_name store developer_name field is empty; no 'Offered by' display name in listing.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Abstract Live Wallpaper Chrome OS Theme [adware] + malext.io malicious_extension_sentry; score 2.79 -> 5.29 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Can manipulate search provider; paired with newtab override increases risk.
• https://api.gameograf.com/* low Scoped host permission to developer's own API endpoint only.
• chrome_url_overrides.newtab medium Replaces new tab page — high-frequency interception surface for all browsing sessions.

Pillar Scores

Bookkeeping