Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Toji Fushiguro Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic account policy — does not scope to this extension; data collection and 3rd-party sharing admitted without extension context.
• New-tab override + search permission: classic search-monetization shell pattern on every new tab.
• Uninstall and install URL hijacking to gameograf.com with UTM tracking — explicit traffic monetization.
• No content security policy (MV3 default relaxed): innerHTML sinks in popup.js and calendar.js create DOM-XSS exposure.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html — replaces every new tab.
• uninstall_url_hijack crx setUninstallURL to https://gameograf.com/?utm_source=gameograf&utm_medium=link&utm_campaign=bg&utm_content=uninstall
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install&utm_medium=link&utm_campaign=bg&utm_content=install
• generic_privacy_policy store Privacy policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• dom_xss_sink crx innerHTML assignments from variables in popup.js and calendar.js; no CSP to mitigate.
• no_developer_name store developer_name is empty string — no 'Offered by' identity in store listing.
• verified_publisher store Verified publisher badge present (support@gameograf.com / gameograf.com resolves).
• maintenance_6_12mo store Last updated November 2025; months_since_update=10 — in 6–12 month stale band.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Toji Fushiguro Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.14 -> 7.64 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying browser search; paired with newtab override amplifies search monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab with extension page — primary monetization surface.
• host_permissions: https://api.gameograf.com/* medium Scoped to own API domain; enables outbound data calls on every new tab open.

Pillar Scores

Bookkeeping