Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Satoru Gojo Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's own policy — not scoped to this extension; extension admits data collection and third-party sharing.
• Uninstall URL hijack redirects to third-party domain (www.ovkas.com), a hard monetization-shell signal.
• New-tab override gives full-browser-reach surface to a 129-install anime wallpaper extension.
• Bundled jquery@1.9.1 carries 3 moderate XSS CVEs (CVE-2019-11358, CVE-2020-11023, CVE-2015-9251); no CSP present.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL points to http://www.ovkas.com/ — third-party monetization redirect.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab for all 129 users.
• generic_privacy_policy store Privacy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• cve_jquery_1.9.1 crx jquery@1.9.1 bundled with 3 moderate XSS CVEs; fixed_in 3.5.0. No CSP to mitigate.
• no_csp manifest content_security_policy is null; MV3 default applies but jquery XSS risk is unmitigated by app-level CSP.
• external_hosts_breadth crx 12 external JS hosts including gameograf.com, api.whatsapp.com, pinterest.com — disproportionate for wallpaper.
• not_verified_not_featured store No verified publisher badge, no Google featured badge; dev domain resolves but no accountability signals.
• install_count_low store Only 129 installs, zero ratings — minimal blast radius but still a live NewTab hijack.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Satoru Gojo Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.44 -> 7.94 (+2.5 cap 2.5).

CVE Exposures (3)

Permissions Breakdown

• search medium Access to search provider; typical for NewTab extensions but can redirect searches.
• topSites medium Reads user's most-visited sites; privacy exposure.
• unlimitedStorage low Local storage only; low direct risk.
• storage low Standard local storage access.
• chrome_url_overrides.newtab medium Replaces every new tab; high reach for a wallpaper/monetization shell.

Pillar Scores

Bookkeeping