Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — BMW Beyond Limits: A Journey to Infinity Wallpapers [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall URL hijacked to gameograf.com — classic monetization shell pattern redirecting users on removal.
• Privacy policy is Google's generic policy (scope_extension=false, admits data collection + 3rd-party sharing) — scores max privacy risk.
• Three medium-severity jQuery 1.9.1 CVEs (XSS) bundled with no CSP — amplified exploit surface on every new tab load.
• NewTab override with 'search' + 'topSites' permissions enables search-query and browsing-pattern monetization.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → gameograf.com with UTM params; classic monetization shell fingerprint.
• generic_privacy_policy store Policy URL is Google's account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• cve_jquery_1.9.1 crx 3 medium CVEs (CVE-2015-9251, CVE-2019-11358, CVE-2020-11023) in jquery@1.9.1; no CSP amplifies XSS risk.
• newtab_override manifest chrome_url_overrides.newtab=index.html; high-reach, every new tab intercepted for 993 users.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP hardens against bundled XSS libs.
• no_developer_name store developer_name is empty string; reduces accountability signal.
• install_url_hijack manifest onInstalled opens index.html internally; low severity but consistent with shell pattern.
• 12_external_js_hosts crx Loads from gameograf.com, jqueryui.com, popper.js.org, pinterest.com, api.whatsapp.com plus 7 others.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — BMW Beyond Limits: A Journey to Infinity Wallpapers [adware] + malext.io malicious_extension_sentry; score 5.45 -> 7.95 (+2.5 cap 2.5).

CVE Exposures (3)

Permissions Breakdown

• search medium Allows reading search queries; combined with NewTab override raises monetization risk.
• topSites medium Exposes user's most-visited sites; useful for NewTab but surveillance-capable.
• unlimitedStorage low Allows large local data storage; low direct risk but enables persistent state.
• storage low Standard local key-value storage; minimal standalone risk.
• chrome_url_overrides.newtab high Replaces every new tab page; high-reach, core monetization vector for this category.

Pillar Scores

Bookkeeping