Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Spirited Away Haku and Chihiro Wallpapers New Tab [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's own policy (not scoped to this extension) but admits data collection and third-party sharing — worst-case privacy signal.
• Uninstall and install URL hijacks redirect to gameograf.com tracking URLs — monetization shell pattern.
• NewTab override gives persistent access to every new tab opened; combined with search permission enables behavioral profiling.
• External JS host mlionltd.github.io is a third-party GitHub Pages domain with no clear affiliation to developer.

Evidence

• privacy_policy_generic store Privacy policy URL is Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 (v3.5 rule D).
• uninstall_url_hijack crx chrome.runtime.setUninstallURL to gameograf.com tracking URL → +3.0 Webstore.
• install_url_hijack crx onInstalled opens gameograf.com tracking URL → +2.0 Webstore.
• newtab_override manifest chrome_url_overrides.newtab present with monetization shape (hijack URLs) → +2.0 Webstore.
• external_js_host_third_party crx mlionltd.github.io in js_external_hosts is not the developer's own domain; supply-chain risk.
• dom_sink_innerhtml crx innerHTML user-controlled sink in popup.js with csp_present=false → +2.0 code quality.
• verified_publisher store Verified publisher (gameograf.com, resolves=true, not throwaway) → -3.0 Reputation, capped at -1.0 (months_since_update=15 > 12, near stale threshold but <18; cap not triggered yet).
• maintenance_stale store months_since_update=15 → 12-24mo band → +6.0 Maintenance.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Spirited Away Haku and Chihiro Wallpapers New Tab [adware] + malext.io malicious_extension_sentry; score 5.23 -> 7.73 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/manipulating search queries; elevated for NewTab category.
• host_permissions: https://api.gameograf.com/* medium Scoped to developer's own API; enables telemetry or data exfil to dev server.
• chrome_url_overrides.newtab medium Replaces new-tab page; persistent monetization/tracking surface on every new tab.

Pillar Scores

Bookkeeping