Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Robot Zamykanie Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override replaces new-tab page — high-reach monetization surface on every new tab.
• Uninstall and install URL hijack to gameograf.com — classic traffic-monetization pattern.
• No CSP declared (MV3) — DOM-XSS sinks in popup.js and calendar.js lack mitigation.
• Developer name absent; small install base (19) with newtab override is anomalous.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html; replaces new-tab on every open.
• uninstall_url_hijack crx setUninstallURL → https://gameograf.com/?utm_source=extension&utm_medium=install
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=extension&utm_medium=install
• no_csp manifest content_security_policy is null; DOM innerHTML sinks present with no CSP guard.
• dom_xss_sink crx innerHTML assignments in popup.js and calendar.js without sanitisation.
• verified_publisher store Extension is verified publisher; discount applied but capped by newtab override.
• privacy_policy api Policy fetched, scoped, collection+retention+third-party-sharing all disclosed.
• low_installs_newtab store Only 19 installs with newtab override + search perm — tail attack surface pattern.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Robot Zamykanie Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.41 -> 6.91 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/modifying search provider; medium risk on its own.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; low direct risk.
• chrome_url_overrides.newtab high Replaces new-tab page — high monetization and data-collection surface.

Pillar Scores

Bookkeeping