Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Blue Porsche Anime Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override replaces every new tab page — persistent high-reach monetization surface.
• Privacy policy is Google's own policy (myaccount.google.com), not scoped to this extension at all.
• Install and uninstall URL hijack to gameograf.com UTM links — confirmed monetization pattern.
• Two unguarded innerHTML sinks (DOM-XSS) with no CSP in place to mitigate exploitation.

Evidence

• newtab_override manifest chrome_url_overrides.newtab present — replaces every new tab for all users.
• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?utm_source=gameograf&utm_campaign=bg&utm_content=uninstall
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install&utm_campaign=bg&utm_content=install
• generic_privacy_policy store Privacy URL is Google's own account policy — scope_extension=false, data_collection=true, 3rd_party=true.
• no_csp manifest content_security_policy is null; MV3 default CSP applies but no explicit extension policy.
• dom_xss_sinks crx Two innerHTML sinks from user-controlled variables in calendar.js and popup.js.
• maintenance_stale store 13 months since last update — falls in 12-24mo band (+6.0).
• search_permission_newtab manifest search permission + newtab override = full search monetization capability.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Blue Porsche Anime Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.81 -> 7.31 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding search provider; paired with newtab override raises monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab — high reach, monetization/redirect surface for all users.
• host_permissions: https://api.gameograf.com/* low Scoped to dev's own API domain; limited blast radius.

Pillar Scores

Bookkeeping