Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Miles Morales Noir Black Spider-Man Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic account policy — not scoped to this extension; data_collection+third_party_sharing admitted with no extension scope.
• NewTab override replaces every new-tab page; combined with 'search' permission and uninstall/install URL hijacks signals search-monetization shell.
• Uninstall and install URL hijacks redirect to gameograf.com tracking URLs — classic traffic-monetization pattern.
• No CSP declared (MV3 default enforced, but dom_sink_innerhtml_userctrl in popup.js elevates XSS risk surface without a policy).

Evidence

• newtab_override manifest chrome_url_overrides.newtab=newtab.html; reaches every new-tab open by user.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• uninstall_url_hijack crx setUninstallURL targets gameograf.com with UTM tracking params.
• install_url_hijack crx onInstalled opens gameograf.com with UTM install tracking params.
• dom_sink_innerhtml_userctrl crx js/popup.js assigns user-controlled var to innerHTML — DOM-XSS sink; no CSP to mitigate.
• stale_newtab store 16 months since update; newtab+search combo unpatched for >1 year.
• verified_publisher_cap_0c api Verified publisher discount capped at -1.0: months_since_update=16 >18 threshold not met, but generic Google policy still triggers full privacy score.
• search_permission_newtab manifest 'search' permission + newtab override = classic search-monetization pattern even with 1 search engine seen.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Miles Morales Noir Black Spider-Man Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.45 -> 7.95 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying/manipulating search; combined with newtab override raises search-monetization concern.
• host_permissions:https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides:newtab high Replaces every new-tab page; high reach for content injection or search monetization.

Pillar Scores

Bookkeeping