Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Shinchan and Shiro Relaxing on Water Lily Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy URL is unreachable (fetch_error); effective no-policy state scores max privacy risk.
• Uninstall and install URL hijack to gameograf.com — classic traffic-monetization shell pattern.
• New-tab override with search permission creates search-hijack/monetization surface.
• Two innerHTML DOM-XSS sinks without CSP protection increase XSS exploitability.

Evidence

• privacy_policy_unreachable api privacy_policy_classification.fetched=false; fetch_error:ConnectionError on api.gameograf.com — treated as no policy.
• uninstall_url_hijack manifest chrome.runtime.setUninstallURL targets https://gameograf.com/?utm_source=extension&utm_medium=install.
• install_url_hijack manifest onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install — monetization redirect.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; combined with search permission = search monetization surface.
• dom_xss_sinks crx Two dom_sink_innerhtml_userctrl findings in popup.js and calendar.js with no CSP (csp_present=false).
• verified_publisher store verified_publisher=true on gameograf.com; domain age 2051 days, resolves, not throwaway.
• no_developer_name store developer_name is empty string; reduces accountability signal.
• js_external_hosts crx 12 external hosts in JS including api.gameograf.com and multiple Google service domains.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Shinchan and Shiro Relaxing on Water Lily Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.62 -> 7.12 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows interaction with browser search; combined with newtab override elevates search monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to own API domain; narrow but enables data exfil to first-party server.
• chrome_url_overrides.newtab medium Replaces new-tab page; prime monetization/search-hijack surface.

Pillar Scores

Bookkeeping