Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Berserk Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override: every new tab is controlled by developer — high monetization and redirect risk.
• Privacy policy is Google's generic account policy — not scoped to this extension at all.
• Uninstall and install URL hijacking to developer marketing URLs — monetization shell pattern.
• No CSP declared (MV3 default stricter but no explicit policy); innerHTML sink in popup.js.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — hijacks every new tab for all users.
• uninstall_url_hijack manifest setUninstallURL targets gameograf.com with UTM params — monetization shell signal.
• install_url_hijack manifest onInstalled opens gameograf.com with UTM install params — monetization shell signal.
• privacy_policy_generic store Policy URL is Google's own account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• privacy_policy_classification api Fetched policy admits data_collection+third_party_sharing but not scoped to extension → +10.0 privacy pillar (v3.5 rule D).
• dom_sink_innerhtml crx js/popup.js: innerHTML assigned from variable — DOM-XSS risk without CSP.
• stale_maintenance store Last updated June 2025 but months_since_update=15 suggests scoring anchor; 12-24mo band → +6.0.
• no_developer_name store developer_name is empty string; verified_publisher true but no display name raises accountability concern.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Berserk Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.52 -> 7.02 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding search provider; medium risk on its own but combined with newtab override elevates concern.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides.newtab high Replaces new tab page — high monetization/redirect surface on every new tab open.

Pillar Scores

Bookkeeping