Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Itachi Uchiha Dark Raven Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic account policy — not scoped to this extension, but admits data collection and 3rd-party sharing (+10 privacy pillar).
• NewTab override + uninstall/install URL hijack to gameograf.com UTM links — classic monetization shell pattern.
• Two innerHTML DOM-XSS sinks with no CSP present, increasing exploitability if any user-controlled data reaches them.
• No developer name listed despite verified-publisher claim; empty manifest display name raises transparency concern.

Evidence

• privacy_policy_generic store Policy URL is Google's own account policy — scope_extension=false, data_collection=true, third_party_sharing=true → +10 privacy.
• uninstall_url_hijack manifest setUninstallURL targets gameograf.com UTM link → +3.0 webstore.
• install_url_hijack manifest onInstalled opens gameograf.com UTM link → +2.0 webstore.
• newtab_override manifest chrome_url_overrides.newtab replaces new-tab page → +2.0 webstore (monetization shape).
• no_csp manifest content_security_policy is null on MV3 — DOM-XSS sinks are unmitigated.
• dom_xss_sinks crx innerHTML from variable in popup.js and calendar.js; no CSP → +2.0 code quality (FIX B).
• developer_name_missing store developer_name is empty string despite verified_publisher=true → +1.0 reputation.
• verified_publisher store verified_publisher=true → -3.0 reputation; capped per invariant 0c check (no stale/CVE/monetization blockers).
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Itachi Uchiha Dark Raven Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.83 -> 7.33 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading and potentially overriding search behavior; medium risk for a NewTab extension.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain only; acceptable for wallpaper data fetching.
• chrome_url_overrides.newtab medium Replaces the new-tab page — high-reach surface for monetization or search hijack.

Pillar Scores

Bookkeeping