Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Moonlit Sakura Valley at Night Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy URL returns connection error — effectively no accessible policy; score treated as unfetched.
• NewTab override combined with uninstall+install URL hijacks to gameograf.com UTM-tracked URLs — monetization shell pattern.
• Two innerHTML DOM-XSS sinks with no CSP present elevate injection risk.
• No developer name disclosed; verified publisher flag present but no accessible privacy policy undermines trust.

Evidence

• privacy_policy_unreachable api fetch_error:ConnectionError on https://api.gameograf.com/gameograf-privacy-policy.html — treated as fetched==false → +10.0 privacy.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL → https://gameograf.com/?utm_source=extension&utm_medium=install (+3.0 webstore).
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=lofi&utm_medium=install (+2.0 webstore).
• newtab_override manifest chrome_url_overrides.newtab present; NewTab monetization category confirmed (+2.0 webstore).
• dom_sink_innerhtml_userctrl crx Two innerHTML sinks (popup.js, calendar.js) with csp_present==false → +2.0 code quality (FIX B).
• no_csp manifest content_security_policy is null on MV3 extension — no CSP mitigation for DOM sinks.
• no_developer_name store developer_name is empty string — +1.0 reputation (no Offered-by identity).
• verified_publisher store verified_publisher==true; -3.0 reputation but floored at 2.0 per hard floor rule; 0c cap does not trigger (domain resolves, no CVEs, <18mo stale).
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Moonlit Sakura Valley at Night Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.59 -> 7.09 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading and potentially influencing search provider; typical for NewTab monetization.
• host_permissions: https://api.gameograf.com/* medium Scoped to dev domain; enables data exfil to own backend.
• chrome_url_overrides.newtab medium Replaces new-tab page; core monetization surface for search/ad injection.

Pillar Scores

Bookkeeping