Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — BMW M760 Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy (scope_extension=false, data_collection=true, third_party_sharing=true) — completely unscoped to this extension.
• NewTab override combined with 'search' permission enables search-provider manipulation and ad-monetization for all new tabs.
• Uninstall and install URL hijack to gameograf.com UTM links — classic traffic-monetization shell pattern.
• Operator cluster: 4 siblings share same dev email/install/uninstall URLs, indicating factory-produced wallpaper shell operation.

Evidence

• newtab_override manifest chrome_url_overrides.newtab replaces every new tab; monetization surface for 2000 installs.
• uninstall_url_hijack manifest setUninstallURL targets https://gameograf.com/?utm_source=gameograf... — 3rd-party UTM redirect.
• install_url_hijack manifest onInstalled opens https://gameograf.com/?utm_source=install... — traffic monetization on install.
• generic_privacy_policy store Policy URL is Google's myaccount policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• operator_cluster api sibling_count=1 compound; dev_email dimension shows 4 siblings — wallpaper shell factory pattern.
• dom_xss_sink_no_csp crx innerHTML sinks in popup.js and calendar.js; csp_present=false increases DOM-XSS risk.
• developer_name_missing store developer_name is empty string; no 'Offered by' display name in store listing.
• verified_publisher store verified_publisher=true; gameograf.com resolves, age 2050 days — partially mitigates reputation risk.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — BMW M760 Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.47 -> 7.97 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Can query the browser search API; combined with newtab override enables search-provider manipulation.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; narrows exfil surface but still allows data upload.
• chrome_url_overrides: newtab medium Replaces every new tab page; high-reach monetization vector, typical of wallpaper shells.

Pillar Scores

Operator Siblings (15)

Other extensions sharing this developer's compound fingerprint:

• kbbpgbdclanolnidddbeolaaddllgebp
• dihbfoicmibapnfojehonedckdjhegbe
• gfgopigkkjcinmgoancipefafljdfghd
• cdmooeifaodbcailnibfpnmbighehpkj
• pjbnoadhjobchdjkfhpehlbigakbjfii
• iobnmhnecelingbpdadgpmalbdagjbnb
• jpmpdfcaaelghoomjgdebmoekdfkhabp
• ohpdpicjlgbpihginhijhkfdcgfbffgf
• cifonlmfhnimmghojdepepjdgbbminel
• dbomdodikcfpocimcpegpbnlmankljcb
• dmdfahkplmikmlboodadelolcmbjgmff
• ckodcbbdgmpjidpfcipfobfagemmfapi
• kbolkhdnpodncbepmdejjijgkdpedgcj
• gfbhidjkgiaopiekkefehamhcmigdcna
• ekmpmfdhakdjaaifkfgpbcagdhlbamki

Bookkeeping