Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Japanese Night Market in Rain Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall and install URL hijack to gameograf.com — classic monetization shell pattern.
• NewTab override with 'search' permission and 12 JS external hosts including chat.openai.com.
• Two innerHTML DOM-XSS sinks with no CSP — potential XSS escalation path.
• No developer name listed; wallpaper category with search permission mismatch.

Evidence

• uninstall_url_hijack + install_url_hijack manifest Both onInstalled and onUninstalled redirect to gameograf.com UTM-tracked URL — monetization shell pattern.
• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — full new-tab replacement for a wallpaper extension.
• search permission manifest 'search' permission declared; not justified for a live wallpaper/newtab aesthetic extension.
• dom_sink_innerhtml_userctrl x2 crx innerHTML assigned from variables in popup.js and calendar.js; no CSP to mitigate DOM-XSS.
• csp_present=false + MV3 manifest No content_security_policy declared; MV3 strict default applies but innerHTML sinks remain risky.
• js_external_hosts crx 12 external hosts including chat.openai.com, calendar.google.com, mail.google.com — broad reach for wallpaper.
• verified_publisher=true + no developer_name store Publisher verified but no display name set; discount applied but capped due to monetization URL pattern.
• privacy_policy_classification api Policy fetched; scope_extension, data_collection, retention, third_party_sharing all true — adequate disclosure.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Japanese Night Market in Rain Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 2.72 -> 5.22 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying/modifying search — elevated for a wallpaper/newtab extension.
• host_permissions: https://api.gameograf.com/* low Scoped to own API domain only; low surface area.
• chrome_url_overrides.newtab medium Replaces new-tab page — monetization vector; core to this extension type.

Pillar Scores

Bookkeeping