Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Peach and Goma Live Wallpapers [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Google's generic privacy policy used — does not scope data practices to this extension at all.
• New-tab override with install/uninstall URL hijack to gameograf.com — monetization shell pattern.
• bit.ly affiliate/cloaking hit in js_external_hosts; affiliate redirect cloaking risk.
• Operator cluster: 24 siblings under same dev email, 43 under same install URL — mass-deploy factory.

Evidence

• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not developer's; scope_extension=false, data_collection=true, third_party_sharing=true.
• newtab_override manifest chrome_url_overrides.newtab = index.html; monetization-shape NewTab with uninstall+install URL hijack.
• install_uninstall_hijack crx Both onInstalled and uninstall redirect to gameograf.com with UTM tracking params.
• operator_cluster_large api dev_email sibling_count=24, install_url sibling_count=43 — mass extension factory fingerprint.
• affiliate_hit_bitly crx bit.ly in js_external_hosts flagged as affiliate/cloaking redirector.
• dom_xss_sink crx innerHTML written from variable in js/popup.js with no CSP — DOM-XSS risk.
• no_developer_name store developer_name is empty string; reduces accountability signal.
• maintenance_stale store 16 months since last update — falls in 12-24mo band (+6.0 maintenance).
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Peach and Goma Live Wallpapers [adware] + malext.io malicious_extension_sentry; score 5.73 -> 8.23 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/manipulating search queries; medium risk in a NewTab context.
• host_permissions: https://api.gameograf.com/* low Scoped to developer-owned API domain; narrow host access.
• chrome_url_overrides.newtab medium Replaces new-tab page — prime real estate for monetization and redirect abuse.

Pillar Scores

Operator Siblings (2)

Other extensions sharing this developer's compound fingerprint:

• eamllpbephefnndpblbpnomcdpmomapa
• jkmbkgbkecfjmfpeignadfchhbonghkm

Bookkeeping