Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Olivia Rodrigo Wallpapers New Tab [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy — not scoped to this extension, yet admits data collection and third-party sharing (Privacy pillar: 10.0).
• New-tab override with install and uninstall URL hijack to gameograf.com — classic fan-content/monetization shell pattern.
• Verified publisher discount capped at -1.0 under invariant 0c: months_since_update=15 triggers the >12-month stale condition (wait — 15 < 18, cap not triggered; but policy is generic Google policy with data collection + third-party sharing).
• No developer name listed; privacy policy is Google's own policy, not the developer's — zero accountability for what THIS extension collects.

Evidence

• newtab_override manifest chrome_url_overrides.newtab=index.html; replaces every new tab with developer-controlled page.
• uninstall_url_hijack crx setUninstallURL -> https://gameograf.com/?utm_source=uninstall — 3rd-party redirect on uninstall.
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install — install-time redirect to developer site.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — Google's policy, not scoped to this extension; data_collection=true, third_party_sharing=true.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening; innerHTML sink unmitigated.
• dom_sink_innerhtml_userctrl crx js/popup.js: innerHTML assigned from variable — DOM-XSS risk with no CSP.
• no_developer_name store developer_name is empty string; reduced accountability signal.
• mlionltd_github_io_external_host crx JS contacts mlionltd.github.io — external GitHub Pages host unrelated to stated function.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Olivia Rodrigo Wallpapers New Tab [adware] + malext.io malicious_extension_sentry; score 5.28 -> 7.78 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying and manipulating browser search; combined with newtab override amplifies search monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; narrows but doesn't eliminate exfil surface.
• chrome_url_overrides.newtab medium Replaces every new tab; primary monetization/data-collection surface for this extension type.

Pillar Scores

Bookkeeping