Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Fortnite Logo on Purple Live Wallpaper Gameograf [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Fortnite brand impersonation by unaffiliated developer (gameograf.com) — confirmed not owner.
• New-tab override with uninstall/install URL hijack to gameograf.com — monetization shell pattern.
• Privacy policy is Google's own policy — does not scope to this extension; data_collection+third_party_sharing admitted without extension context.
• No CSP declared (MV3); two innerHTML DOM-XSS sinks in popup.js and calendar.js.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'fortnite'; confirmed_owner=false; developer is gameograf.com.
• newtab_override_with_monetization manifest chrome_url_overrides.newtab set + uninstall_url_hijack + install_url_hijack both true pointing to gameograf.com UTM URLs.
• privacy_policy_generic_google store Policy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true.
• dom_xss_no_csp crx Two innerHTML sinks (popup.js, calendar.js) with csp_present=false — DOM-XSS risk elevated.
• no_developer_name store developer_name is empty string; verified_publisher=true but no public display name.
• verified_publisher store verified_publisher=true; applies -1.0 cap discount under v3.5 invariant 0c due to generic policy.
• operator_cluster_singleton api sibling_count=0; no sibling extensions detected under this fingerprint.
• maintenance_6_12mo store months_since_update=11; falls in 6-12mo band (+3.5).
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Fortnite Logo on Purple Live Wallpaper Gameograf [adware] + malext.io malicious_extension_sentry; score 4.57 -> 7.07 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Can read/manipulate search queries; medium risk for a NewTab extension.
• host_permissions: https://api.gameograf.com/* low Scoped to developer-controlled domain only; limited blast radius.
• chrome_url_overrides.newtab medium Replaces new-tab page — primary monetization surface, high user-facing impact.

Pillar Scores

Bookkeeping