Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Satoru Gojo Lofi Sytle Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy — no scope to this extension; data collection & 3rd-party sharing admitted without extension context.
• NewTab override + search permission = search monetization shell pattern; uninstall & install URL hijack confirmed.
• No developer name provided; verified-publisher discount reduced due to generic policy and install/uninstall URL hijacking.
• Two innerHTML DOM-XSS sinks with no CSP present — XSS risk amplified by missing content security policy.

Evidence

• newtab_override_with_monetization manifest chrome_url_overrides.newtab set to newtab.html; install and uninstall URLs redirect to gameograf.com with UTM params.
• uninstall_url_hijack crx uninstall_url_target=https://gameograf.com/?utm_source=extension&utm_medium=install confirms monetization redirect.
• install_url_hijack crx install_url_target=https://gameograf.com/?utm_source=lofi&utm_medium=install on onInstalled event.
• privacy_policy_generic api Policy URL is Google's account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• dom_xss_no_csp crx Two innerHTML sinks in popup.js and calendar.js with csp_present=false — DOM-XSS risk elevated per FIX B.
• no_developer_name store developer_name is empty string; reduces accountability.
• verified_publisher store verified_publisher=true for support@gameograf.com; partial reputation credit applied.
• maintenance_3_6mo store months_since_update=6; falls in 3-6 month band (+1.5 maintenance).
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Satoru Gojo Lofi Sytle Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.79 -> 7.29 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows override of search provider; medium risk on its own but paired with newtab override.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; narrows network risk significantly.
• chrome_url_overrides.newtab medium Replaces new-tab page; high user-facing impact, monetization vector for wallpaper shells.

Pillar Scores

Bookkeeping