Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Aespa Wallpapers New Tab by Gameograf [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override with uninstall URL hijack to developer domain — classic monetization shell pattern.
• 9 moderate-severity CVEs in bundled jquery@1.9.1, jquery@3.4.1, jquery-ui@1.12.1; all below fixed versions.
• No CSP defined (MV3 extension); combined with vulnerable jQuery libs raises XSS surface.
• 12 external JS hosts referenced including social, CDN, and third-party domains expanding attack surface.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL targets gameograf.com with UTM params — monetization redirect on uninstall.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab for all users.
• cve_moderate_multiple crx 9 moderate CVEs across jquery-ui@1.12.1 (4 CVEs) and jquery@3.4.1 (2) and jquery@1.9.1 (3); none at fixed version.
• no_csp manifest content_security_policy is null; MV3 default CSP applies but no explicit hardening declared.
• 12_external_js_hosts crx JS references 12 distinct external hosts including api.whatsapp.com, jqueryui.com, www.crazycraftz.com.
• verified_publisher store Verified publisher badge present; discount capped at -1.0 due to months_since_update==18 (>=18mo threshold).
• stale_18mo_with_cves store Last updated March 2025, 18 months; with CVEs present triggers triple-stale fingerprint +2.0 webstore bonus.
• privacy_policy_adequate api Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true — full disclosure.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Aespa Wallpapers New Tab by Gameograf [adware] + malext.io malicious_extension_sentry; score 4.34 -> 6.84 (+2.5 cap 2.5).

CVE Exposures (9)

Permissions Breakdown

• search medium Can read/manipulate search queries; typical for NewTab but elevates risk.
• topSites low Read-only access to most visited sites; low sensitivity.
• unlimitedStorage low Allows unlimited local storage; low direct risk.
• storage low Standard local key-value storage; low risk.
• chrome_url_overrides.newtab medium Replaces every new tab with extension page; high-reach monetization surface.

Pillar Scores

Bookkeeping