Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Naruto Uzumaki Flaming Live Wallpaper New Tab [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override replaces every new tab; persistent monetization surface with uninstall/install URL hijacks.
• Uninstall and install URL hijacks redirect to gameograf.com with UTM tracking on every install/uninstall.
• No CSP declared; DOM-XSS innerHTML sink in popup.js has no mitigating policy.
• Developer name field empty; verified publisher but no display name reduces accountability.

Evidence

• newtab_override manifest chrome_url_overrides.newtab=newtab.html — replaces every new tab for all 1K users.
• uninstall_url_hijack crx setUninstallURL targets https://gameograf.com/?utm_source=gameograf&utm_medium=link&utm_campaign=bg.
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install — 3rd-party redirect on install.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP hardening.
• dom_xss_sink crx innerHTML user-controlled assignment in js/popup.js with no CSP protection.
• verified_publisher store Verified publisher badge present; domain gameograf.com resolves; not throwaway.
• maintenance_stale store Last updated June 3 2025; 15 months since update — falls in 12-24mo band (+6.0).
• privacy_policy_adequate api Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Naruto Uzumaki Flaming Live Wallpaper New Tab [adware] + malext.io malicious_extension_sentry; score 4.56 -> 7.06 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/modifying search queries; relevant to NewTab search monetization.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces every new tab — high reach, persistent user exposure.

Pillar Scores

Bookkeeping