Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Sanrio Hello Kitty Cute Pink Playroom Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override with 'search' permission and install/uninstall URL hijacks to gameograf.com — classic ad-monetization shell pattern.
• Uninstall URL hijack routes to developer site with UTM tracking; install URL hijack does the same.
• No developer name listed; verified publisher discount partially offset by monetization-shape signals.
• DOM-XSS sinks (innerHTML from variable) in popup.js and calendar.js with no CSP to mitigate.

Evidence

• newtab_override_with_search_permission manifest chrome_url_overrides.newtab set + 'search' permission declared — monetization NewTab pattern.
• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?utm_source=extension&utm_medium=install
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install
• no_csp_mv3 manifest csp_present == false on MV3 extension; dom_sink_innerhtml_userctrl findings unmitigated.
• dom_sink_innerhtml_userctrl crx innerHTML sinks in js/popup.js and js/calendar.js — DOM-XSS risk without CSP.
• no_developer_name store developer_name is empty string; identity accountability reduced.
• privacy_policy_adequate api Policy fetched, scoped to extension, discloses collection/retention/3rd-party sharing.
• broad_js_external_hosts crx 12 external JS hosts including chat.openai.com, multiple Google domains beyond stated wallpaper function.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Sanrio Hello Kitty Cute Pink Playroom Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 2.75 -> 5.25 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/modifying search queries; combined with newtab override raises monetization concern.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain only.
• chrome_url_overrides.newtab medium Replaces new-tab page — primary surface for search monetization and data collection.

Pillar Scores

Bookkeeping