Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Frieren Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override replaces every new tab; combined with search permission enables ad/affiliate monetization on each open.
• Privacy policy is Google's generic account policy — not scoped to this extension at all (scope_extension=false, collects+shares data).
• Uninstall and install URL hijacks redirect to gameograf.com with UTM tracking on every install/remove event.
• bit.ly affiliate/cloaking link in JS external hosts — destination unknown, potential redirect chain to ad-tech.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html; replaces every new tab page.
• uninstall_url_hijack crx setUninstallURL -> gameograf.com with UTM params; +3.0 Webstore per rubric.
• install_url_hijack crx onInstalled opens gameograf.com UTM URL; +2.0 Webstore per rubric.
• affiliate_hit crx bit.ly in js_external_hosts flagged as affiliate/cloaking redirector by threat_intel.
• generic_privacy_policy store Policy URL is Google Account policy; scope_extension=false, data_collection=true, third_party_sharing=true -> +10.0 Privacy (v3.5 D).
• verified_publisher store verified_publisher=true; discount capped at -1.0 per invariant 0c/0e: monetization hits present (affiliate_hits non-empty).
• stale_extension store 16 months since update -> +6.0 Maintenance pillar.
• no_developer_name store developer_name is empty string; contributes to Reputation uncertainty.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Frieren Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.48 -> 7.98 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/modifying search engine; medium risk but paired with newtab override amplifies monetization concern.
• chrome_url_overrides.newtab medium Replaces every new tab — primary monetization surface for ad/affiliate injection.

Pillar Scores

Bookkeeping