Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Sakuna Yuji Itadori Jujutsu Kaisen JJK Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall and install URL hijack redirect to gameograf.com marketing URL — confirmed monetization shell.
• Privacy policy is Google's generic policy, not scoped to this extension; admits data collection and 3rd-party sharing.
• NewTab override with search permission enables persistent user tracking and search monetization.
• No CSP on MV3 extension with innerHTML sinks in popup.js and calendar.js (DOM-XSS risk).

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → https://gameograf.com/?utm_source=dekuy&utm_medium=dekuy (3rd-party monetization).
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=dekuy&utm_medium=dekuy — confirmed install hijack.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; search permission also declared — monetization surface.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension.
• dom_xss_sink crx innerHTML assigned from variable in popup.js and calendar.js with no CSP present.
• fan_content_shell store Anime/manga character wallpaper with newtab override + UTM affiliate redirects = traffic-monetization shell.
• developer_mismatch store Developer name 'dekuy.com' differs from email domain 'gameograf.com' and UTM domain — identity fragmentation.
• no_csp manifest content_security_policy is null; MV3 default helps but no explicit CSP with active DOM sinks is elevated risk.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Sakuna Yuji Itadori Jujutsu Kaisen JJK Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.30 -> 7.80 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/modifying search provider; medium risk for a NewTab extension.
• host_permissions: https://api.gameograf.com/* medium Scoped to developer's own API domain; enables data exfiltration to operator.
• chrome_url_overrides.newtab medium Replaces new tab page — primary monetization/surveillance surface for this category.

Pillar Scores

Bookkeeping