Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Katsuki Bakugo Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall & install URL both hijack to gameograf.com UTM affiliate — confirmed monetization shell pattern.
• Privacy policy is Google's own policy (not scoped to this extension), admits data collection and 3rd-party sharing: worst-case privacy score.
• NewTab override + 'search' permission enables silent search/traffic monetization on every new tab.
• JS contacts major social/video platforms (Instagram, Netflix, YouTube, X) with no stated functional need.

Evidence

• install_url_hijack + uninstall_url_hijack crx Both onInstalled and uninstall redirect to gameograf.com with UTM params — textbook monetization shell.
• newtab_override manifest chrome_url_overrides.newtab = index.html replaces every new tab; combined with search permission = search monetization surface.
• generic_privacy_policy store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension. data_collection & third_party_sharing both true.
• external_js_hosts crx gameograf.com, Instagram, Netflix, YouTube, X contacted from JS — far beyond wallpaper function.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit restriction.
• new_tab_monetization manifest Pillar: +2.0 newtab override with monetization shape; +3.0 uninstall URL hijack; +2.0 install URL hijack.
• operator_cluster api sibling_count=0 but fingerprint includes gameograf.com UTM across all hooks — single-extension monetization operator.
• privacy_policy_classification api fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true → v3.5(D) → +10.0 privacy pillar.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Katsuki Bakugo Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.49 -> 7.99 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/modifying search engine settings; combined with newtab override amplifies monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab page; primary vector for ad-monetization and search hijacking.

Pillar Scores

Bookkeeping