Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Sauber Formula 1 Car Wallpapers New Tab by Gameograf [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override replaces every new tab — primary search monetization and redirect surface.
• Uninstall URL hijack + install URL hijack both point to gameograf.com with UTM tracking.
• No CSP defined (csp_present=false, MV3 default applied) — innerHTML sink in popup.js raises DOM-XSS risk.
• months_since_update=15 (6–18mo stale range) raises abandonment/supply-chain concern.

Evidence

• newtab_override manifest chrome_url_overrides.newtab=index.html — every new tab replaced; search monetization shape.
• uninstall_url_hijack crx setUninstallURL to https://gameograf.com/?utm_source=uninstall — tracking on removal.
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install — UTM tracking on install.
• no_csp manifest content_security_policy is null; MV3 strict default applies but no explicit CSP hardening.
• external_host_github_pages crx mlionltd.github.io in js_external_hosts — unverifiable third-party GitHub Pages domain.
• dom_xss_sink crx popup.js: popupContainer.innerHTML = html — unescaped variable in DOM sink.
• stale_extension store Last updated June 2025; months_since_update=15 — in 6–18mo stale band.
• verified_publisher store Verified publisher badge present; domain resolves; no throwaway signals — partial trust credit.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Sauber Formula 1 Car Wallpapers New Tab by Gameograf [adware] + malext.io malicious_extension_sentry; score 3.33 -> 5.83 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows search provider interaction; paired with NewTab override amplifies search monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to dev-controlled API domain only; narrow and expected for NewTab data fetch.
• chrome_url_overrides.newtab medium Replaces every new tab; primary surface for monetization and search redirect.

Pillar Scores

Bookkeeping