Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Darth Vader Live Wallpaper - Gameograf [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic account policy, not scoped to this extension; data collection and 3rd-party sharing admitted without extension context — worst-case privacy score.
• NewTab override + 'search' permission = classic monetization shell; uninstall and install URL hijacks to developer site confirm traffic-monetization pattern.
• Uninstall URL hijack and install URL hijack both fire to gameograf.com with UTM tracking, indicating user-journey monitoring.
• No developer name listed; developer_name is empty string, reducing accountability.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces every new tab for all users.
• uninstall_url_hijack crx setUninstallURL targets https://gameograf.com/darth-vader-live-wallpaper/?utm_source=extension&utm_medium=uninstall
• install_url_hijack crx onInstalled opens https://gameograf.com/darth-vader-live-wallpaper/?utm_source=extension&utm_medium=install
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension at all.
• privacy_policy_classification api scope_extension=false, data_collection=true, third_party_sharing=true → D clause: +10.0 privacy score.
• dom_xss_sink crx js/calendar.js assigns innerHTML from variable; no CSP present on MV3 extension.
• developer_name_missing store developer_name is empty string; no 'Offered by' accountability signal.
• search_permission_newtab_combo manifest search + newtab override combined with 523 installs; monetization shell fingerprint.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Darth Vader Live Wallpaper - Gameograf [adware] + malext.io malicious_extension_sentry; score 5.48 -> 7.98 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/manipulating search queries; combined with newtab override raises monetization risk.
• alarms low Scheduling only; minimal standalone risk.
• storage low Local data persistence; low risk alone.
• chrome_url_overrides.newtab medium Replaces every new tab; high-reach surface for monetization and data capture.
• host_permissions: https://api.gameograf.com/* medium Scoped to developer's own API; acceptable but enables data exfil to dev server.

Pillar Scores

Bookkeeping