Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Cursed King Sukuna’s Blade Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override replaces browser new-tab page — core monetization/search-hijack vector.
• Uninstall URL hijack and install URL hijack both point to gameograf.com tracking URLs.
• New-tab override with search permission is a textbook search-monetization shell pattern.
• No developer name listed in store despite verified-publisher status.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html; search permission also declared — NewTab monetization pattern.
• uninstall_url_hijack crx Uninstall redirects to https://gameograf.com/?p=34610?utm_source=extension&utm_medium=uninstall
• install_url_hijack crx Install opens https://gameograf.com/?p=34610?utm_source=extension&utm_medium=install
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension with innerHTML sink.
• dom_xss_sink crx js/calendar.js uses innerHTML from variable; no CSP to mitigate DOM-XSS.
• verified_publisher_no_dev_name store verified_publisher=true but developer_name is empty string.
• privacy_policy api Policy fetched, scoped, data_collection=true, retention=true, third_party_sharing=true — adequate.
• low_installs store Only 25 installs; tail-attack-surface anomaly not flagged but extension is effectively unvetted by users.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Cursed King Sukuna’s Blade Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.12 -> 6.62 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Can query/manipulate search engine settings; medium risk for a NewTab extension.
• alarms low Schedules timed events; low standalone risk.
• storage low Persists local data; low risk.
• chrome_url_overrides.newtab medium Replaces New Tab page — primary surface for monetization/search hijack.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; not broad.

Pillar Scores

Bookkeeping