Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Supra Drift Live Wallpaper New Tab [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override with install/uninstall URL hijack — monetization shell pattern confirmed.
• No CSP on MV3 extension with innerHTML sinks in popup.js and calendar.js — DOM-XSS risk.
• Uninstall and install URL redirect to gameograf.com — tracking funnel on both lifecycle events.
• Developer name absent from listing; reduces accountability despite verified publisher badge.

Evidence

• newtab_override manifest chrome_url_overrides.newtab=newtab.html — replaces every new tab for all users.
• uninstall_url_hijack crx setUninstallURL points to gameograf.com with UTM params — 3rd-party tracking on uninstall.
• install_url_hijack crx onInstalled opens gameograf.com with UTM params — tracking funnel on install.
• dom_sink_innerhtml_userctrl crx innerHTML sinks in popup.js and calendar.js with no CSP — DOM-XSS attack surface.
• no_csp manifest content_security_policy is null; MV3 default CSP applies but no explicit restriction set.
• verified_publisher store Developer has verified publisher badge; discount applied but developer_name is empty.
• privacy_policy_third_party_sharing api Policy scoped, discloses data collection + retention + third-party sharing — adequate.
• maintenance_6_12mo store Last updated Oct 2025 — 11 months; falls in 6-12mo band (+3.5).
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Supra Drift Live Wallpaper New Tab [adware] + malext.io malicious_extension_sentry; score 3.10 -> 5.60 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying browser search engine; relevant but grants search access for NewTab.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain only; limited blast radius.
• chrome_url_overrides.newtab medium Replaces new-tab page — primary monetization/tracking surface for this category.

Pillar Scores

Bookkeeping