Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Hello Kitty Flying Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy (not extension-scoped) and admits data collection + third-party sharing — worst-case privacy failure.
• NewTab override + 'search' permission = persistent search-monetization surface on every new tab.
• Uninstall and install URL hijacks redirect to developer's UTM-tagged domain — monetization shell pattern.
• Two DOM-XSS innerHTML sinks with no CSP on MV3 extension handling calendar/popup data.

Evidence

• privacy_policy_generic store Policy URL is Google's account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy pillar (v3.5 D).
• newtab_override manifest chrome_url_overrides.newtab replaces every new-tab page; combined with 'search' permission for monetization.
• uninstall_url_hijack crx setUninstallURL targets https://gameograf.com with UTM params → +3.0 webstore.
• install_url_hijack crx onInstalled opens https://gameograf.com with UTM params → +2.0 webstore.
• dom_xss_sinks_no_csp crx 2x innerHTML from variable in popup.js and calendar.js; csp_present=false → +2.0 code quality (FIX B).
• verified_publisher_featured store Both verified_publisher and is_featured_by_google are true; discounts applied but monetization pattern limits them (v3.5 E).
• no_developer_name store developer_name is empty despite verified publisher status — reduces accountability signal.
• maintenance_6_to_12_months store months_since_update=10 → +3.5 maintenance pillar.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Hello Kitty Flying Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.83 -> 7.33 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying the browser's default search engine; combined with newtab override amplifies search-monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; narrows exfil surface but still allows data egress.
• chrome_url_overrides.newtab medium Replaces every new-tab page; primary vector for search monetization and persistent user exposure.

Pillar Scores

Bookkeeping