Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Mitsuri Kanroji Close Up Aesthetic Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override with uninstall+install URL hijack to gameograf.com — traffic monetization shell pattern.
• Uninstall and install URL hijack both redirect to developer domain with UTM tracking parameters.
• Two innerHTML DOM-XSS sinks (popup.js, calendar.js) with no CSP; MV3 but csp_present==false.
• No developer name listed; verified publisher but anonymous operator identity.

Evidence

• uninstall_url_hijack + install_url_hijack manifest Both onInstall and onUninstall redirect to gameograf.com with UTM params — monetization shell signal.
• chrome_url_overrides newtab manifest Extension replaces new-tab page; combined with search permission = search monetization surface.
• dom_sink_innerhtml_userctrl x2 crx innerHTML sinks in popup.js and calendar.js; no CSP present — XSS risk if data from API is attacker-controlled.
• csp_present == false manifest MV3 extension has no content_security_policy declared; amplifies DOM-XSS sink risk.
• verified_publisher + no developer_name store Publisher verified but developer_name is empty string; reduced but not eliminated identity risk.
• privacy_policy classification api Policy fetched, scoped to extension, discloses data collection, retention, and third-party sharing — adequate.
• js_external_hosts breadth crx 12 external hosts including Google services and api.gameograf.com; no bad-host hits in threat_intel.
• install_count=36, rating=0 store Extremely low adoption; no ratings — limited blast radius currently but installs may grow.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Mitsuri Kanroji Close Up Aesthetic Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.10 -> 6.60 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/modifying search queries; combined with newtab override increases search monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides: newtab medium Replaces new-tab page; primary surface for traffic monetization and search redirection.

Pillar Scores

Bookkeeping