Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — My Melody Tree Live Wallpaper by Sanrio [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override replaces every new tab with developer-controlled page enabling persistent tracking and ad injection.
• Uninstall and install URL hijacks both fire to gameograf.com with UTM tracking parameters.
• No CSP on MV3 extension with innerHTML DOM sinks in popup.js and calendar.js — XSS risk if API response is attacker-controlled.
• Extension contacts chat.openai.com and 11 external JS hosts despite being a wallpaper/theme extension — scope mismatch.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — controls every new tab page.
• uninstall_url_hijack crx setUninstallURL to https://gameograf.com/?utm_source=extension&utm_medium=install
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install
• external_hosts_scope_mismatch crx Wallpaper extension contacts chat.openai.com, 6 Google services, ssl.gstatic.com — 12 external hosts.
• no_csp manifest content_security_policy is null on MV3; innerHTML sinks in popup.js and calendar.js are unmitigated.
• dom_xss_sinks crx dom_sink_innerhtml_userctrl in js/popup.js and js/calendar.js — potential XSS if data from API is untrusted.
• privacy_policy_third_party_sharing api Policy scoped, admits data collection + third-party sharing + retention. Adequate but shares with third parties.
• low_install_newtab_search_override store Only 161 installs with newtab + search permissions — low-visibility tail attack surface.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — My Melody Tree Live Wallpaper by Sanrio [adware] + malext.io malicious_extension_sentry; score 4.26 -> 6.76 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding search provider; medium risk for search hijack.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain only.
• chrome_url_overrides.newtab medium Replaces new tab page; primary monetization/control surface for this extension.

Pillar Scores

Bookkeeping