Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Rick and Morty Parallel Universe [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall and install URL hijack to gameograf.com — classic traffic-monetization shell pattern.
• NewTab override with search permission: persistent replacement of every new tab page.
• Two DOM-XSS sinks (innerHTML from variable) with no CSP — potential XSS vector.
• No developer name listed; low-install (34) Fan/entertainment shell raises authenticity concerns.

Evidence

• install_url_hijack manifest onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install — monetization redirect.
• uninstall_url_hijack manifest setUninstallURL targets https://gameograf.com/?utm_source=extension&utm_medium=install — 3rd-party hijack.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; replaces every new tab with extension page.
• no_csp manifest content_security_policy is null; no CSP on MV3 extension with innerHTML sinks.
• dom_xss_sink crx innerHTML user-controlled in popup.js and calendar.js with no CSP mitigation.
• search_permission manifest Permission 'search' declared alongside NewTab override — search provider manipulation risk.
• no_developer_name store developer_name is empty string; no 'Offered by' identity visible to users.
• third_party_data_sharing api Privacy policy confirms data_collection=true and third_party_sharing=true.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Rick and Morty Parallel Universe [adware] + malext.io malicious_extension_sentry; score 2.72 -> 5.22 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Can manipulate search queries/provider; medium risk in NewTab context.
• host_permission: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces every new tab; persistent reach over browsing session.

Pillar Scores

Bookkeeping