Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Black Myth Wukong Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's own policy — not scoped to this extension; collects and shares data with third parties.
• NewTab override replaces every new tab with monetization tracking (install/uninstall UTM hijack URLs).
• Uninstall and install URL hijacks redirect to gameograf.com with UTM campaign tracking.
• No content_security_policy declared (MV3 fallback only); DOM-XSS innerHTML sinks in popup.js and calendar.js.

Evidence

• privacy_policy_generic store Policy URL is Google's own privacy policy (myaccount.google.com); scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy.
• newtab_override manifest chrome_url_overrides.newtab set to newtab.html; permanent high-reach replacement of every new-tab page.
• uninstall_url_hijack crx setUninstallURL to https://gameograf.com/?utm_source=gameograf&utm_campaign=bg — 3rd-party UTM tracking on uninstall.
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install — 3rd-party page opened on install.
• dom_xss_sinks crx innerHTML assignments in popup.js and calendar.js without CSP; XSS risk elevated with csp_present=false.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• verified_publisher store verified_publisher=true for gameograf.com (resolves, not throwaway); -3.0 Reputation discount applied.
• developer_name_missing store developer_name is empty string; partial reputation concern offset by verified publisher status.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Black Myth Wukong Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.38 -> 7.88 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying the browser search service; medium risk in a NewTab override context.
• host_permissions: https://api.gameograf.com/* low Scoped to own API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces every new-tab page; persistent high-reach monetization surface.

Pillar Scores

Bookkeeping