Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Katsuki Bakugo: Ignite Your Heroic Spirit! Gameograf [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's own policy (not scoped to this extension) — admits data collection and 3rd-party sharing without extension-specific disclosure.
• NewTab override replaces every new tab; combined with install/uninstall URL hijacks signals ad-monetization shell pattern.
• Uninstall and install URL hijacks redirect to gameograf.com with UTM tracking — classic traffic-monetization pattern.
• External JS host mlionltd.github.io is a non-developer GitHub Pages domain with no clear ownership linkage.

Evidence

• privacy_policy_generic store Policy URL is Google's global privacy policy (myaccount.google.com/privacypolicy); scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 Privacy (v3.5-D).
• install_uninstall_url_hijack manifest Both install and uninstall hooks redirect to gameograf.com with UTM params; +2.0+3.0 Webstore per rubric.
• newtab_override manifest chrome_url_overrides.newtab set to index.html; NewTab monetization shape, +2.0 Webstore.
• external_host_unknown crx mlionltd.github.io listed in js_external_hosts; not a dev-controlled domain, unexplained third-party dependency.
• dom_xss_sink crx dom_sink_innerhtml_userctrl in js/popup.js; csp_present=false triggers +2.0 Code Quality (FIX B).
• maintenance_stale store months_since_update=15; 12-24 month band → +6.0 Maintenance.
• no_developer_name store developer_name is empty string; +1.0 Reputation.
• verified_publisher_cap store verified_publisher=true but months_since_update=15 >12mo and monetization_hits context; invariant 0c caps discount at -1.0.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Katsuki Bakugo: Ignite Your Heroic Spirit! Gameograf [adware] + malext.io malicious_extension_sentry; score 5.38 -> 7.88 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows override of search provider; paired with newtab override increases monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to own API domain; low direct risk but establishes outbound telemetry channel.
• chrome_url_overrides.newtab medium Replaces every new tab; high-reach monetization surface, scored per v2 calibration (a).

Pillar Scores

Bookkeeping