Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Gojo Infinity Live Wallpaper New Tab [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy URL returns HTTP error — policy effectively unfetchable; scored as no policy.
• NewTab override replaces every new tab; uninstall+install URL hijack sends tracking pings to gameograf.com.
• No CSP present (MV3 but csp_present=false) combined with innerHTML DOM-XSS sink in popup.js.
• Developer name missing; verified publisher discount limited by stale update (15mo) triggering v3.5 cap.

Evidence

• privacy_policy_fetch_failed api Privacy policy URL fetch returned HTTPError; classified as fetched=false → scored +10.0 privacy.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() targets https://gameograf.com/?utm_source=gameograf... (3rd-party tracking).
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install... monetization ping on every install.
• newtab_override manifest chrome_url_overrides.newtab=newtab.html; replaces every new tab for all 2,000 users.
• no_csp crx content_security_policy is null; csp_present=false on MV3 extension with innerHTML sink.
• dom_xss_sink crx popup.js assigns innerHTML from variable without sanitization; DOM-XSS risk amplified by absent CSP.
• verified_publisher_stale store Verified publisher but months_since_update=15 (>12); v3.5 cap limits discount to -1.0 max.
• developer_name_missing store developer_name is empty string; no 'Offered by' identity visible to users.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Gojo Infinity Live Wallpaper New Tab [adware] + malext.io malicious_extension_sentry; score 5.33 -> 7.83 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding search behavior; medium risk for a NewTab extension that replaces search UX.
• host_permission: https://api.gameograf.com/* low Scoped to dev-controlled domain only; limited blast radius.
• chrome_url_overrides.newtab medium Replaces every new tab; high REACH, monetization/redirect vector.

Pillar Scores

Bookkeeping