Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — One Piece Netflix Monkey D. Luffy New Tab [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy — fetched, not scoped to this extension, admits data collection and 3rd-party sharing: Privacy pillar maxed at 10.
• Brand impersonation: title references 'Netflix' without confirmed ownership, is_impersonation=true, verified_publisher offers no discount here.
• Uninstall and install URL hijacks both present — classic NewTab monetization shell behavior.
• New-tab override with monetization shape (install/uninstall UTM tracking to gameograf.com); no developer name listed.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; 'Netflix' in title; developer domain gameograf.com not confirmed Netflix owner.
• generic_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true → Privacy=10.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL targets gameograf.com with UTM params; install URL hijack also present.
• newtab_override_monetization manifest chrome_url_overrides.newtab='index.html'; install/uninstall UTM tracking; NewTab with monetization shape.
• dom_sink_innerhtml_userctrl crx js/popup.js: innerHTML assigned from variable with no CSP; DOM-XSS sink. csp_present=false amplifies risk.
• no_developer_name store developer_name is empty string; reduces accountability.
• stale_16mo store months_since_update=16; Maintenance pillar elevated; invariant 0c caps verified-publisher discount at -1.0.
• external_host_mlionltd_github_io crx js_external_hosts includes mlionltd.github.io — third-party GitHub Pages host outside dev's primary domain.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — One Piece Netflix Monkey D. Luffy New Tab [adware] + malext.io malicious_extension_sentry; score 5.39 -> 7.89 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying/altering search behavior; medium risk in NewTab context.
• host_permissions: https://api.gameograf.com/* low Scoped to own API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces new-tab page; standard for NewTab extensions but enables persistent monetization.

Pillar Scores

Bookkeeping