Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Gameograf ONE - Live Wallpapers [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override replaces every new tab page; high-reach monetization/tracking surface.
• Uninstall URL hijack redirects to 3rd-party goodbye page (monetization shell signal).
• Install URL hijack opens 3rd-party welcome page on install.
• Suspicious host in js_external_hosts: gameograf.com.evil.com — potential subdomain hijack or exfil indicator.

Evidence

• newtab_override manifest chrome_url_overrides.newtab='newtab.html' — replaces new tab for all users.
• uninstall_url_hijack crx setUninstallURL to https://gameograf.com/one/goodbye.html — monetization/tracking signal.
• install_url_hijack crx onInstalled opens https://gameograf.com/one/welcome.html — common in monetization shells.
• suspicious_external_host crx js_external_hosts includes 'gameograf.com.evil.com' — possible subdomain hijack or exfil.
• dom_xss_sink crx innerHTML from variable in js/calendar.js; no CSP present (MV3 but csp_present=false).
• verified_featured_publisher store verified_publisher=true AND is_featured_by_google=true; Reputation floored at 2.0.
• privacy_policy_classification api Policy fetched, scoped to extension, documents collection/retention/3rd-party sharing.
• no_developer_name store developer_name is empty string despite verified publisher badge.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Gameograf ONE - Live Wallpapers [adware] + malext.io malicious_extension_sentry; score 3.20 -> 5.70 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/overriding search provider; concerning in NewTab context.
• storage low Standard local state persistence; low standalone risk.
• chrome_url_overrides.newtab medium Replaces every new tab page; high-reach monetization surface.
• host: https://api.gameograf.com/* low Scoped to developer-controlled API endpoint.
• host: https://gameograf.com/* low Scoped to developer domain only.

Pillar Scores

Bookkeeping