Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Obito Uchiha with Mask Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall URL hijack redirects to gameograf.com UTM tracking — traffic monetization signal.
• Install URL hijack opens 3rd-party page on install — onboarding monetization.
• NewTab override + search permission: classic ad/monetization shell pattern.
• No CSP on MV3 extension with innerHTML DOM sinks in popup.js and calendar.js.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → https://gameograf.com/?utm_source=extension&utm_medium=install
• install_url_hijack manifest onInstalled opens https://gameograf.com/?utm_source=lofi&utm_medium=install
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; combined with search permission.
• operator_cluster api dev_email fingerprint matches 50 other extensions under support@gameograf.com.
• dom_sink_innerhtml crx Two innerHTML-from-variable sinks in popup.js and calendar.js with no CSP.
• no_developer_name store developer_name is empty string; no verified publisher badge.
• privacy_policy api Policy fetched; scope, collection, retention, third-party sharing all disclosed.
• cve_findings crx No CVEs found; jquery 3.7.1 is current and clean.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Obito Uchiha with Mask Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.28 -> 6.78 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Can manipulate search provider; paired with newtab override raises monetization concern.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; expected for a NewTab extension.
• chrome_url_overrides.newtab medium Replaces new tab page — high visibility surface, monetization vector.

Pillar Scores

Bookkeeping