Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Space Marine Live Wallpaper Gameograf [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy URL returns fetch error — effectively no accessible privacy policy (score +10.0).
• Uninstall URL hijack to gameograf.com with UTM tracking (+3.0 webstore).
• Install URL hijack to gameograf.com on onInstalled (+2.0 webstore).
• NewTab override with search permission — monetization shell pattern; single search engine (Google).

Evidence

• privacy_policy_fetch_error api Privacy policy URL https://gameograf.com/privacy-policy/ returned HTTPError; treated as fetched==false → +10.0 privacy.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL to https://gameograf.com/?utm_source=gameograf... (+3.0 webstore).
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install... (+2.0 webstore).
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; NewTab shell with search permission (+2.0 webstore).
• dom_xss_no_csp crx Two innerHTML sinks in popup.js and calendar.js; csp_present==false elevates each to +2.0 code quality.
• verified_publisher store Verified publisher badge present; -3.0 reputation. No monetization hits so cap does not apply.
• no_developer_name store developer_name is empty string; +1.0 reputation penalty.
• maintenance_3_6mo store months_since_update=10; falls in 6-12mo band → +3.5 maintenance.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Space Marine Live Wallpaper Gameograf [adware] + malext.io malicious_extension_sentry; score 4.47 -> 6.97 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading search queries; medium risk on its own but paired with newtab override raises concern.
• host_permissions: https://api.gameograf.com/* low Scoped to dev-controlled API domain only.
• chrome_url_overrides.newtab medium Replaces new-tab page; monetization vector, captures user attention on every new tab.

Pillar Scores

Bookkeeping