Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Inosuke Hashibira Live Wallpaper New Tab [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Google Privacy Policy used as extension policy — admits data collection/3rd-party sharing but not scoped to this extension (+10.0 privacy).
• New-tab override with uninstall AND install URL hijacks to gameograf.com — classic monetization shell pattern (+3.0+2.0 webstore).
• No developer name listed; verified publisher discount partially offset by missing identity and generic policy.
• innerHTML sink in calendar.js without CSP present — DOM-XSS risk elevated by absent content_security_policy.

Evidence

• privacy_policy_generic_google store Privacy URL is Google's own policy (myaccount.google.com/privacypolicy); scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (v3.5 rule D).
• uninstall_url_hijack crx chrome.runtime.setUninstallURL targets https://gameograf.com/…?utm_medium=uninstall → +3.0 webstore.
• install_url_hijack crx onInstalled opens https://gameograf.com/…?utm_medium=install → +2.0 webstore.
• newtab_override manifest chrome_url_overrides.newtab set; NewTab with monetization shape → +2.0 webstore.
• no_csp manifest content_security_policy is null/csp_present=false on MV3 extension with DOM sink finding.
• dom_sink_innerhtml_userctrl crx js/calendar.js uses innerHTML from variable without CSP → code quality +2.0 (FIX B: no CSP present).
• developer_name_missing store developer_name is empty string; +1.0 reputation (no 'Offered by' name).
• verified_publisher store verified_publisher=true → -3.0 reputation; no 0c cap trigger (stale<18mo, no CVEs, domain resolves, no monetization/affiliate hits).
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Inosuke Hashibira Live Wallpaper New Tab [adware] + malext.io malicious_extension_sentry; score 5.36 -> 7.86 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/manipulating search queries; typical for NewTab but enables search monetization.
• alarms low Schedules background tasks; low direct harm potential.
• storage low Local data persistence; low risk standalone.
• chrome_url_overrides.newtab medium Replaces new-tab page; core monetization surface for this category.
• host_permissions: https://api.gameograf.com/* medium Extension-owned API endpoint; enables data exfil from newtab context.

Pillar Scores

Bookkeeping