Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Happy easter [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override with install+uninstall URL hijack to gameograf.com ad tracking URL — clear monetization shell.
• Uninstall URL hijack routes user to UTM-tagged affiliate landing page on extension removal.
• Install URL hijack opens 3rd-party UTM-tagged URL on install — forced navigation.
• DOM-XSS sinks (innerHTML) in popup.js and calendar.js without CSP; injection risk if server-side content is compromised.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces every new tab.
• uninstall_url_hijack crx setUninstallURL -> https://gameograf.com/?utm_source=dekuy&utm_medium=dekuy
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=dekuy&utm_medium=dekuy
• dom_xss_sink crx innerHTML user-controlled in popup.js and calendar.js; no CSP present (MV3 default-src only).
• dev_identity_mismatch store Developer name Dekuy.com vs email domain gameograf.com — split brand identity.
• no_installs_reported store Install count missing; tail-attack-surface cannot be confirmed but anomaly noted.
• privacy_policy_adequate api Policy fetched, scoped to extension, declares data collection, retention, and third-party sharing.
• cve_clean crx jquery 3.7.1 bundled — no CVEs found; cve_findings_raw empty.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Happy easter [adware] + malext.io malicious_extension_sentry; score 3.20 -> 5.70 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding search provider; paired with newtab override = monetization surface.
• https://api.gameograf.com/* medium Host permission to developer API; enables data exfil to own server.
• chrome_url_overrides.newtab high Replaces every new-tab page; primary monetization/tracking vector.

Pillar Scores

Bookkeeping