Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Kyojuro Rengoku Demon Slayer Gameograf [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override replaces every new tab, enabling persistent search/ad monetization without user awareness.
• Uninstall and install URL hijacks send tracking parameters to gameograf.com — confirmed traffic monetization.
• Privacy policy URL returned fetch error; policy effectively unavailable, earning maximum privacy score.
• Two innerHTML DOM-XSS sinks with no CSP — injected content could exploit users if API responses are tainted.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html — replaces every new tab page for all users.
• uninstall_url_hijack crx setUninstallURL points to gameograf.com with utm tracking params — confirmed webstore penalty.
• install_url_hijack crx onInstalled opens gameograf.com with utm_source=install — traffic monetization on every install.
• privacy_policy_fetch_error api privacy_policy_classification.fetched=false (HTTPError); policy inaccessible, scored +10 privacy.
• dom_xss_sink_no_csp crx 2x innerHTML from variable in popup.js and calendar.js; CSP absent — DOM-XSS risk elevated.
• search_permission manifest search permission declared alongside newtab override — classic search monetization combo.
• no_developer_name store developer_name is empty string — reduced accountability, +1.0 reputation penalty.
• domain_age_established api gameograf.com cert first issued 2021-02-03, 265 certs, 2050 days old — not a throwaway domain.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Kyojuro Rengoku Demon Slayer Gameograf [adware] + malext.io malicious_extension_sentry; score 5.38 -> 7.88 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows override of default search provider — monetization vector for NewTab extensions.
• chrome_url_overrides.newtab high Replaces every new tab page; high-reach surface for search monetization and data collection.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.

Pillar Scores

Bookkeeping