Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Cristiano Ronaldo Anime Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override combined with uninstall/install URL hijacks signals monetization shell pattern.
• No content security policy on MV3 extension with DOM innerHTML sinks in popup.js and calendar.js.
• Developer name field empty; low rating (2/5) raises trust concerns.
• Install and uninstall URL hijacks redirect users to gameograf.com with tracking parameters.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL to gameograf.com with UTM tracking params — monetization indicator.
• install_url_hijack manifest onInstalled opens gameograf.com with UTM params — install traffic monetization.
• newtab_override manifest chrome_url_overrides.newtab replaces every new tab; combined with search perm = ad-monetization shape.
• no_csp manifest content_security_policy is null; DOM innerHTML sinks present in popup.js and calendar.js.
• dom_sink_innerhtml_userctrl crx innerHTML assigned from variable in popup.js and calendar.js — DOM-XSS risk without CSP.
• low_rating store Rating of 2/5 with no developer name listed; reputational red flag.
• verified_publisher store Publisher verified via gameograf.com which resolves and is not throwaway.
• privacy_policy_adequate api Policy scoped to extension, discloses collection, retention, and third-party sharing.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Cristiano Ronaldo Anime Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.29 -> 6.79 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Can read/manipulate search queries; medium risk on its own.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; low blast radius.
• chrome_url_overrides.newtab medium Replaces new-tab page; standard NewTab monetization vector.

Pillar Scores

Bookkeeping