Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Travis Scott Takes on Fortnite Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy URL is on a different domain (haberikra.com) and fetch failed — effectively no accessible policy.
• Fortnite brand impersonation: developer (gameograf.com) is not confirmed owner of Fortnite IP.
• Uninstall URL hijack redirects to gameograf.com with UTM tracking; install hijack also present.
• New-tab override combined with 'search' permission is classic ad-monetization shell pattern.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'fortnite'; confirmed_owner=false; dev domain is gameograf.com.
• privacy_policy_fetch_failure api privacy_policy_classification.fetched=false (HTTPError); policy on unrelated domain haberikra.com.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() targets gameograf.com with UTM params.
• install_url_hijack crx onInstalled opens gameograf.com with UTM install tracking params.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; standard monetization shell vector.
• no_developer_name store developer_name is empty string; reduces accountability.
• dom_xss_sink crx js/popup.js: innerHTML assigned from variable with no CSP; DOM-XSS risk.
• months_since_update_15 store Last updated June 2025; 15 months since update — in 6-12mo stale band.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Travis Scott Takes on Fortnite Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.73 -> 8.23 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying browser search; medium risk in context of NewTab override.
• host:https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces new-tab page; central monetization vector for wallpaper/shell extensions.

Pillar Scores

Bookkeeping