Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — ILLIT 아일릿 Current Wallpapers New Tab by Gameograf [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override with uninstall URL hijack to K-pop category page — monetization shell pattern.
• 9 moderate CVEs across jquery@1.9.1, jquery@3.4.1, jquery-ui@1.12.1 (XSS); no CSP amplifies risk.
• No CSP on MV3 extension with vulnerable DOM-manipulation libs bundled.
• Install URL hijack (onInstalled redirect) adds traffic-hijack surface.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → https://gameograf.com/category/k-pop/ (3rd-party traffic capture).
• install_url_hijack crx onInstalled opens index.html; classified as install URL hijack.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab for all users.
• cve_moderate_x9 crx 9 moderate CVEs: jquery-ui@1.12.1 (4 XSS), jquery@3.4.1 (2 XSS), jquery@1.9.1 (3 XSS).
• no_csp manifest content_security_policy is null; XSS CVEs in bundled libs are unmitigated.
• stale_extension store Last updated May 2025 (16 months ago); CVE-laden libs not patched.
• external_js_hosts crx 12 external JS hosts including api.whatsapp.com, www.crazycraftz.com, jqueryui.com.
• verified_publisher store Verified publisher badge present; discount capped at -1.0 due to stale >18mo.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — ILLIT 아일릿 Current Wallpapers New Tab by Gameograf [adware] + malext.io malicious_extension_sentry; score 4.62 -> 7.12 (+2.5 cap 2.5).

CVE Exposures (9)

Permissions Breakdown

• topSites medium Reads browser top sites; relevant for NewTab but exposes browsing habits.
• unlimitedStorage low Allows large local data storage; minor risk on its own.
• storage low Standard local data persistence; low risk.
• chrome_url_overrides.newtab medium Replaces every new tab page; high reach, monetization surface.

Pillar Scores

Bookkeeping