Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Bart Simpson Rides a Skateboard Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override monetization shell with install and uninstall URL hijacks to gameograf.com.
• Privacy policy is Google's generic account policy — does not scope to this extension at all (admits data collection and 3rd-party sharing).
• No developer name listed; verified publisher without 'Offered by' identity is accountability gap.
• DOM-XSS sink (innerHTML) in popup.js with no CSP, enabling XSS if API response is unsanitized.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set — every new tab is controlled by this extension.
• uninstall_url_hijack crx setUninstallURL to https://gameograf.com/?utm_source=gameograf — confirmed URL hijack on removal.
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=install — monetization redirect on install.
• privacy_policy_generic_google store Privacy policy is myaccount.google.com/privacypolicy — not scoped to this extension; data_collection=true, third_party_sharing=true.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP hardening.
• dom_xss_sink crx js/popup.js: innerHTML assigned from variable without sanitization — DOM-XSS risk.
• no_developer_name store developer_name is empty string — accountability gap despite verified_publisher flag.
• stale_newtab store 15 months since last update; NewTab+search override with no CSP and no developer identity.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Bart Simpson Rides a Skateboard Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.41 -> 7.91 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/modifying search queries; medium risk alone but paired with NewTab override raises concern.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; low breadth but enables outbound data calls.
• chrome_url_overrides: newtab medium Replaces new tab page — high-visibility monetization surface and persistent user touchpoint.

Pillar Scores

Bookkeeping