Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Reverse 1999 Live Wallpaper - Windy Day [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and 3rd-party sharing (score: 10.0).
• New-tab override combined with install/uninstall URL hijacks signals monetization shell pattern.
• Two innerHTML DOM-XSS sinks in popup.js and calendar.js with no CSP to mitigate.
• No developer name listed; verified publisher badge mitigates but accountability gap remains.

Evidence

• privacy_policy_generic store PP URL is myaccount.google.com — Google's own policy, scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces every new tab for all users.
• uninstall_url_hijack crx setUninstallURL to gameograf.com with UTM tracking params → +3.0 webstore.
• install_url_hijack crx onInstalled opens gameograf.com with UTM tracking params → +2.0 webstore.
• dom_sink_innerhtml_userctrl crx Two innerHTML sinks found (popup.js, calendar.js); no CSP present → DOM-XSS risk elevated.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension with innerHTML sinks.
• verified_publisher store Verified publisher badge present (gameograf.com resolves, not throwaway) → -3.0 reputation.
• developer_name_missing store developer_name is empty string; no 'Offered by' display name → +1.0 reputation.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Reverse 1999 Live Wallpaper - Windy Day [adware] + malext.io malicious_extension_sentry; score 4.77 -> 7.27 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/modifying search provider; medium risk on its own.
• host_permissions: https://api.gameograf.com/* medium Scoped to dev's own API domain; enables outbound data calls.
• chrome_url_overrides.newtab medium Replaces new-tab page; high user-surface reach, monetization vector.

Pillar Scores

Bookkeeping