Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Chiikawa Wallpaper New Tap [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and 3rd-party sharing (+10 privacy pillar).
• Uninstall and install URL hijacks both redirect to gameograf.com tracking URLs (+3.0+2.0 webstore).
• NewTab override replaces every new-tab page; verified publisher but no developer name displayed.
• External JS host mlionltd.github.io is a GitHub Pages domain outside developer's primary domain — uncontrolled third-party dependency.

Evidence

• uninstall_url_hijack manifest setUninstallURL → https://gameograf.com/?utm_source=uninstall&utm_medium=link&utm_campaign=bg&utm_content=uninstall
• install_url_hijack manifest onInstalled opens https://gameograf.com/?utm_source=install&utm_medium=link&utm_campaign=bg&utm_content=install
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not extension-scoped; data_collection+third_party_sharing=true.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab for all users.
• external_host_github_pages crx js_external_hosts includes mlionltd.github.io — uncontrolled third-party GitHub Pages domain.
• dom_sink_innerhtml crx dom_sink_innerhtml_userctrl in js/popup.js; no CSP present (csp_present=false), XSS risk.
• no_developer_name store developer_name is empty string; verified_publisher=true but identity not prominently disclosed.
• verified_publisher_featured store verified_publisher=true and is_featured_by_google=true; partial trust credit applied.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Chiikawa Wallpaper New Tap [adware] + malext.io malicious_extension_sentry; score 4.72 -> 7.22 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Grants ability to query/alter default search provider; typical for NewTab but elevates capability.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; expected for wallpaper/NewTab fetching.
• chrome_url_overrides.newtab medium Replaces every new tab page; high-reach surface for monetization or tracking.

Pillar Scores

Bookkeeping