Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Avengers Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's own generic policy — not scoped to this extension; admits data collection and 3rd-party sharing (v3.5-D: +10.0 privacy).
• New-tab override + search permission creates monetization surface; uninstall and install URL hijacks to gameograf.com confirmed.
• 15-month-old extension with verified-publisher discount capped at -1.0 (stale >12mo) under invariant 0c.
• innerHTML DOM-XSS sink in popup.js with no CSP present (MV3, no explicit CSP declared).

Evidence

• newtab_override manifest chrome_url_overrides.newtab=newtab.html; search permission also declared — classic NewTab monetization shape.
• uninstall_url_hijack crx uninstall_url_target=https://gameograf.com/?utm_source=gameograf&utm_campaign=bg — confirmed hijack.
• install_url_hijack crx install_url_target=https://gameograf.com/?utm_source=install&utm_campaign=bg — confirmed hijack.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension; data_collection+3rd_party_sharing=true.
• no_developer_name store developer_name field is empty; no 'Offered by' identity surfaced.
• dom_xss_sink crx popup.js: popupContainer.innerHTML=html — unguarded DOM-XSS sink; csp_present=false.
• verified_publisher_stale store verified_publisher=true but months_since_update=15; discount capped at -1.0 per invariant 0c (stale>12mo).
• maintenance_stale store 15 months since last update → +6.0 maintenance pillar (12-24mo band).
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Avengers Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.17 -> 7.67 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows manipulation of search queries/provider; medium risk on its own.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain only.
• chrome_url_overrides.newtab medium Replaces new-tab page; high-traffic monetization surface.

Pillar Scores

Bookkeeping