Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Curious Cats Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Google account privacy policy used — not scoped to this extension; data_collection+third_party_sharing admitted without extension context.
• NewTab override replaces every new tab; uninstall and install URL hijacks redirect to developer site with UTM tracking.
• No developer name listed; privacy policy is Google's generic policy, not extension-specific.
• Stale 16 months with NewTab override — monetization shape with limited accountability.

Evidence

• newtab_override manifest chrome_url_overrides.newtab=newtab.html replaces every new tab page.
• uninstall_url_hijack crx setUninstallURL targets gameograf.com with UTM campaign tracking on uninstall.
• install_url_hijack crx onInstalled opens gameograf.com with UTM campaign tracking on install.
• generic_privacy_policy store Privacy URL is Google's account policy (myaccount.google.com) — scope_extension=false, data_collection=true, third_party_sharing=true.
• no_developer_name store developer_name is empty string; reduces accountability.
• dom_xss_sink crx innerHTML assigned from variable in popup.js without CSP protection.
• stale_newtab store 16 months since update; NewTab+search override pattern with install/uninstall hijack = monetization shell fingerprint.
• verified_publisher store Verified publisher badge present for gameograf.com; domain resolves, not throwaway.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Curious Cats Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.55 -> 8.05 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying browser search; paired with newtab override raises search-monetization concern.
• chrome_url_overrides.newtab high Replaces every new tab — high reach, enables search redirection and ad injection.
• host_permissions: https://api.gameograf.com/* medium Scoped to own API domain; enables data exfiltration to developer-controlled endpoint.

Pillar Scores

Bookkeeping