Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Decorated Christmas Tree Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override: replaces every new tab, enabling persistent tracking and ad injection across all browsing sessions.
• Operator cluster of 45 extensions under same dev email — mass-production wallpaper/newtab monetization factory.
• Privacy policy is Google's own generic policy (not scoped to this extension) while data_collection and third_party_sharing are true — scored as worst-case.
• Uninstall and install URL hijacks redirect to gameograf.com with UTM tracking parameters.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — every new tab controlled by extension.
• uninstall_url_hijack crx setUninstallURL targets https://gameograf.com/ with UTM params — behavioural tracking on uninstall.
• install_url_hijack crx onInstalled opens https://gameograf.com/ with UTM install params — 3rd-party redirect on install.
• operator_cluster api sibling_count=13 compound; dev_email cluster=45 extensions under support@gameograf.com.
• generic_privacy_policy store Policy URL is Google's own account policy — scope_extension=false, data_collection=true, third_party_sharing=true.
• dom_xss_sink crx innerHTML assignments from variables in popup.js and calendar.js; no CSP to mitigate.
• no_csp manifest content_security_policy is null (MV3 default strict, but no explicit policy declared).
• no_developer_name store developer_name is empty string — no identity accountability in store listing.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Decorated Christmas Tree Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.27 -> 6.77 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Can manipulate browser search provider settings.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain only.
• chrome_url_overrides.newtab medium Replaces every new tab — prime real estate for monetization and tracking.

Pillar Scores

Operator Siblings (15)

Other extensions sharing this developer's compound fingerprint:

• kbbpgbdclanolnidddbeolaaddllgebp
• kgdahhodabbdnkkphjpneoiadhdphhna
• dihbfoicmibapnfojehonedckdjhegbe
• gfgopigkkjcinmgoancipefafljdfghd
• cdmooeifaodbcailnibfpnmbighehpkj
• pjbnoadhjobchdjkfhpehlbigakbjfii
• iobnmhnecelingbpdadgpmalbdagjbnb
• jpmpdfcaaelghoomjgdebmoekdfkhabp
• ohpdpicjlgbpihginhijhkfdcgfbffgf
• cifonlmfhnimmghojdepepjdgbbminel
• dbomdodikcfpocimcpegpbnlmankljcb
• dmdfahkplmikmlboodadelolcmbjgmff
• ckodcbbdgmpjidpfcipfobfagemmfapi
• gfbhidjkgiaopiekkefehamhcmigdcna
• ekmpmfdhakdjaaifkfgpbcagdhlbamki

Bookkeeping