Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — My Neighbor Totoro Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing (Privacy pillar maxed).
• Uninstall and install URL hijacks redirect users to gameograf.com for monetization tracking.
• NewTab override + search permission = classic ad-monetization shell pattern.
• No developer name disclosed; verified publisher discount limited by stale update (15mo) and generic policy.

Evidence

• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 Privacy (v3.5 rule D).
• uninstall_url_hijack crx chrome.runtime.setUninstallURL targets gameograf.com with UTM params — +3.0 Webstore.
• install_url_hijack crx onInstalled opens gameograf.com with UTM params — +2.0 Webstore.
• newtab_override manifest chrome_url_overrides.newtab replaces every new-tab; combined with search perm = monetization pattern.
• no_developer_name store developer_name is empty string — +1.0 Reputation.
• verified_publisher_capped store Verified publisher but months_since_update=15 >12 and generic policy — verified discount capped at -1.0 per v3.5 invariant 0c.
• dom_xss_sink_no_csp crx innerHTML in popup.js with csp_present=false triggers elevated dom_sink risk (+2.0 Code Quality FIX B).
• maintenance_stale store 15 months since update → +6.0 Maintenance pillar.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — My Neighbor Totoro Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.49 -> 7.99 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/overriding search queries; combined with newtab override = monetization surface.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; reasonable for wallpaper fetch.
• chrome_url_overrides.newtab medium Replaces every new-tab page; primary monetization vector for this extension type.

Pillar Scores

Bookkeeping