Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Bluey Wallpapers New Tab Gameograf [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's own policy (not scoped to extension), admits data collection and 3rd-party sharing — scores maximum privacy risk.
• Uninstall and install URL hijack both fire to gameograf.com tracking URLs — classic monetization/tracking shell pattern.
• NewTab override with search permission gives persistent user-session access and search behavior visibility.
• No CSP declared (MV3 strict default applies but no explicit policy); innerHTML DOM-XSS sink in popup.js.

Evidence

• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not extension-scoped; data_collection+3rd_party_sharing both true.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL targets gameograf.com with UTM tracking params.
• install_url_hijack crx onInstalled opens gameograf.com with UTM tracking params — monetization shell indicator.
• newtab_override manifest chrome_url_overrides.newtab = index.html; persistent access to every new tab session.
• dom_xss_sink crx innerHTML assigned from variable in js/popup.js without sanitization; DOM-XSS risk.
• developer_name_missing store developer_name is empty string; reduces accountability signal.
• stale_extension store 16 months since last update; verified-publisher discount capped at -1.0 due to monetization pattern (v3.5 invariant 0c/E).
• external_host_mlionltd_github crx js_external_hosts includes mlionltd.github.io — third-party GitHub-hosted resource, unrelated to stated function.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Bluey Wallpapers New Tab Gameograf [adware] + malext.io malicious_extension_sentry; score 5.40 -> 7.90 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading and manipulating browser search queries; medium risk in NewTab context.
• host_permissions: https://api.gameograf.com/* low Scoped to dev-owned API domain only; limited blast radius.
• chrome_url_overrides: newtab medium Replaces new-tab page; monetization vector and persistent user exposure.

Pillar Scores

Bookkeeping