Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Red Goku Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override with uninstall+install URL hijack — classic monetization shell pattern.
• Verified publisher but no developer name listed; 14-month stale update on NewTab.
• innerHTML DOM-XSS sink in popup.js with no CSP present (MV3 default, but no explicit policy).
• New-tab override + search permission enables search-redirect monetization surface.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces every new tab with extension page.
• uninstall_url_hijack manifest setUninstallURL target: gameograf.com with UTM params — traffic monetization on uninstall.
• install_url_hijack manifest onInstalled opens gameograf.com with UTM params — install hijack confirmed.
• dom_sink_innerhtml crx js/popup.js: popupContainer.innerHTML = html — DOM-XSS sink, no CSP to mitigate.
• no_developer_name store developer_name is empty string despite verified_publisher == true.
• stale_newtab store 14 months since last update on a NewTab extension (6-12mo band = +3.5 maintenance).
• privacy_policy_adequate api Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true.
• search_engine_count_1 api Only google.com seen in search_engines_seen; no multi-engine monetization aggregator signal.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Red Goku Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.34 -> 6.84 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/modifying search queries; medium risk in context of NewTab override.
• host_permissions: https://api.gameograf.com/* low Scoped to own API domain only; low blast radius.
• chrome_url_overrides.newtab medium Replaces new-tab page; monetization and search-redirect surface.

Pillar Scores

Bookkeeping