Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Liverpool Wallpapers [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override with uninstall/install URL hijack — classic monetization shell pattern.
• bit.ly affiliate/cloaking hit in js_external_hosts; destination URL hidden.
• mlionltd.github.io as external JS host is unverified third-party code source.
• No CSP on MV3 extension with innerHTML DOM-XSS sink in popup.js.

Evidence

• newtab_override_with_url_hijacks manifest chrome_url_overrides.newtab set; uninstall_url_hijack and install_url_hijack both true pointing to gameograf.com UTM links.
• affiliate_hit_bitly crx bit.ly listed in js_external_hosts and affiliate_hits — generic short-link redirector used for affiliate/cloaking.
• unverified_external_host crx mlionltd.github.io is an external JS host not controlled by developer domain; supply-chain risk.
• no_csp_with_dom_xss_sink crx csp_present=false; dom_sink_innerhtml_userctrl found in js/popup.js; XSS risk elevated without CSP guard.
• stale_update_verified_publisher_cap store months_since_update=15 (>12); verified_publisher discount capped at -1.0 per v3.5 rule 0c (stale>18 not met but affiliate_hits non-empty triggers cap).
• verified_publisher_no_dev_name store verified_publisher=true but developer_name is empty string; reputation floor applies.
• new_tab_monetization_pattern manifest NewTab category + search permission + install/uninstall UTM hijack = classic traffic-monetization cluster.
• privacy_policy_scoped_and_adequate api Privacy policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true, third_party_silence=false.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Liverpool Wallpapers [adware] + malext.io malicious_extension_sentry; score 4.72 -> 7.22 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows search provider manipulation; paired with newtab override increases monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; low standalone risk.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary monetization/redirect surface for this extension type.

Pillar Scores

Bookkeeping