Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Hello Kitty Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy (not extension-scoped) but admits data collection & 3rd-party sharing — worst-case privacy score.
• Uninstall and install URL hijacks redirect to developer domain with UTM tracking — monetization shell signal.
• NewTab override replaces every new tab; combined with 'search' permission this is a classic traffic-monetization surface.
• Two innerHTML sinks without CSP (csp_present=false) elevate DOM-XSS risk across popup and calendar UI.

Evidence

• privacy_policy_generic_google store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension; data_collection+third_party_sharing true.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL points to gameograf.com with UTM params — monetization/tracking on uninstall.
• install_url_hijack crx onInstalled opens gameograf.com with UTM install params — traffic monetization on install.
• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces every new tab page for all users.
• dom_sink_innerhtml_no_csp crx Two innerHTML sinks in popup.js and calendar.js; csp_present=false amplifies DOM-XSS exposure.
• no_developer_name store developer_name is empty string despite verified_publisher badge; reduces accountability.
• verified_publisher_featured store Extension carries verified_publisher and is_featured_by_google; discounts applied to reputation pillar.
• no_csp_mv3 manifest content_security_policy is null; MV3 has strict default but extension sets no explicit CSP, raising innerHTML risk.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Hello Kitty Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.24 -> 7.74 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying the browser's search engine; relevant to NewTab/search override pattern.
• host_permissions: https://api.gameograf.com/* medium Scoped to developer's own API; used for wallpaper assets, but creates outbound data channel.
• chrome_url_overrides.newtab medium Replaces every new tab — high-reach surface, monetization vector for wallpaper shells.

Pillar Scores

Bookkeeping