Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Anime Forest Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy — not scoped to this extension, yet admits data collection and 3rd-party sharing (+10.0 privacy).
• Uninstall and install URL hijacks redirect to gameograf.com tracking URLs — monetization shell pattern.
• NewTab override with search permission: all new-tab navigations and searches potentially monetized.
• Developer name is blank; verified publisher discount partially offsets but governance gap remains.

Evidence

• install_url_hijack manifest onInstalled opens gameograf.com with UTM params — monetization install hook.
• uninstall_url_hijack manifest setUninstallURL to gameograf.com UTM link — confirmed monetization shell signal (+3.0 webstore).
• newtab_override manifest chrome_url_overrides.newtab = index.html; captures every new tab.
• privacy_policy_generic store Policy is myaccount.google.com/privacypolicy — not scoped to extension, admits data collection+3rd-party sharing.
• external_js_host_anomaly crx mlionltd.github.io listed as JS host — unrelated 3rd-party GitHub pages domain, no explanation.
• developer_name_missing store developer_name is empty string despite verified_publisher flag.
• dom_sink_innerhtml_userctrl crx popup.js assigns innerHTML from variable — DOM-XSS sink without CSP guard.
• stale_16mo store 16 months since update; maintenance pillar scores 6.0 (6-12 mo band boundary).
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Anime Forest Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.37 -> 7.87 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading search terms; paired with NewTab override, enables search monetization.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; low blast radius.
• chrome_url_overrides.newtab medium Replaces new-tab page; monetization vector, captures all new-tab navigation.

Pillar Scores

Bookkeeping