Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Battlefield Sekiro Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and 3rd-party sharing (D clause → +10.0).
• New-tab override with 'search' permission is a classic search-monetization pattern; uninstall/install URL hijacks confirmed.
• Two innerHTML DOM-XSS sinks with no CSP present elevate XSS risk on the replaced new-tab page.
• No developer name listed; verified publisher badge partially offsets but reputation discount capped by newtab+search capability gate.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html; replaces every new-tab page for all users.
• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?utm_source=gameograf&utm_campaign=bg&utm_content=uninstall
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install&utm_campaign=bg&utm_content=install
• privacy_policy_generic api Policy URL is Google's own privacy page; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0.
• dom_xss_no_csp crx Two innerHTML sinks in popup.js and calendar.js; csp_present=false amplifies DOM-XSS risk per FIX B.
• no_developer_name store developer_name is empty string; verified_publisher=true partially mitigates but capability gate limits discount.
• verified_publisher_capability_gate store v2 0b: verified-publisher -2.0 discount blocked by newtab override (HIGH-impact capability).
• jquery_3.7.1_no_cve crx jquery 3.7.1 bundled; no CVEs found in cve_findings_raw — no CVE pillar addition.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Battlefield Sekiro Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.29 -> 7.79 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Grants access to search queries; paired with newtab override raises monetization risk.
• chrome_url_overrides.newtab high Replaces new-tab page — primary attack surface for search hijacking and ad injection.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited reach.

Pillar Scores

Bookkeeping