Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Satoru Gojo Suit Wallpaper New Tab [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override with uninstall+install URL hijack to gameograf.com (monetization tracking).
• No CSP declared (csp_present=false); DOM-XSS sinks in popup.js and calendar.js unmitigated.
• Developer name blank; no 'Offered by' field despite verified publisher status.
• NewTab category with search permission raises ad-monetization concern even with single search engine.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL to https://gameograf.com/?utm_source=gameograf — monetization tracking.
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install — traffic monetization on install.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html replaces every new tab for 2000 users.
• no_csp crx content_security_policy is null; MV3 default applies but no explicit hardening.
• dom_xss_sinks crx innerHTML assigned from variables in popup.js and calendar.js without CSP script-src protection.
• blank_developer_name store developer_name is empty string despite verified_publisher=true.
• verified_publisher store verified_publisher=true; domain resolves, not throwaway, no bad-host hits.
• privacy_policy_adequate api Policy fetched, scoped to extension, covers data collection, retention, and third-party sharing.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Satoru Gojo Suit Wallpaper New Tab [adware] + malext.io malicious_extension_sentry; score 3.15 -> 5.65 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying/overriding search; medium risk for a NewTab extension.
• host_permissions: https://api.gameograf.com/* low Scoped to developer-controlled API domain only.
• chrome_url_overrides.newtab medium Replaces new-tab page; core mechanism for this category but adds monetization surface.

Pillar Scores

Bookkeeping