Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Crimson Gaze Anime Eye Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override captures all new-tab traffic; paired with 'search' permission creates monetization/redirect surface.
• Privacy policy is Google's generic policy — does not scope to this extension; data collection and 3rd-party sharing admitted without extension-specific disclosure.
• Uninstall and install URL hijacks track user lifecycle via UTM parameters to gameograf.com.
• Two innerHTML DOM-XSS sinks with no CSP — API response or injected content could trigger XSS.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html; every new tab routed through extension.
• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?utm_source=gameograf&utm_campaign=bg&utm_content=uninstall
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install&utm_medium=link&utm_campaign=bg
• generic_privacy_policy api Privacy URL is myaccount.google.com/privacypolicy — scope_extension=false, admits data_collection+3rd_party_sharing.
• dom_xss_sink_no_csp crx innerHTML sinks in popup.js and calendar.js; csp_present=false; no mitigation against XSS.
• no_developer_name store developer_name is empty string; verified_publisher=true but no human-readable org identity.
• new_tab_monetization_pattern manifest search permission + newtab override + install/uninstall tracking URLs = monetization shell fingerprint.
• verified_publisher store verified_publisher=true, domain resolves, not throwaway — partially mitigates reputation risk.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Crimson Gaze Anime Eye Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.45 -> 7.95 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows search-provider interaction; paired with newtab override raises monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides.newtab medium NewTab override redirects all new-tab traffic through extension; monetization surface.

Pillar Scores

Bookkeeping