Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Ender Miles Morales Snow Time Live Spiderman Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic account policy — not scoped to this extension; scope_extension=false, data_collection=true, third_party_sharing=true → Privacy pillar 10.0.
• NewTab override replaces every new tab + install/uninstall URL hijacks point to gameograf.com UTM tracking — monetization shell pattern.
• Two innerHTML DOM-XSS sinks (popup.js, calendar.js) with no CSP present — elevated exploitation risk.
• No developer name listed; verified_publisher present but policy discounts capped due to no-name and generic Google policy.

Evidence

• privacy_policy_generic store Privacy policy URL points to Google's account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html — replaces every new-tab page for all users.
• install_uninstall_hijack manifest Both install and uninstall URL hijacks redirect to gameograf.com with UTM campaign tracking.
• dom_xss_sink crx innerHTML assigned from variables in popup.js and calendar.js with no CSP; DOM-XSS risk.
• no_csp manifest content_security_policy is null; csp_present=false. No mitigation for XSS sinks.
• no_developer_name store developer_name is empty string; reduces accountability signals.
• verified_publisher store verified_publisher=true; partial reputation credit, but capped by generic policy and no-name.
• maintenance_stale store months_since_update=12; falls in 6-12mo band (+3.5 maintenance).
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Ender Miles Morales Snow Time Live Spiderman Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.30 -> 7.80 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding or querying the browser search provider; relevant for NewTab monetization.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; contained but still allows outbound data egress.
• chrome_url_overrides.newtab medium Replaces every new-tab page; high-reach surface for monetization or content injection.

Pillar Scores

Bookkeeping