Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Son Goku Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection and 3rd-party sharing: privacy pillar maxed at 10.
• Uninstall and install URL hijacks redirect to gameograf.com tracking URLs — classic monetization shell behavior.
• NewTab override with 'search' permission and no CSP; wallpaper category masks search-engine monetization surface.
• DOM-XSS sink (innerHTML from variable) in calendar.js with no CSP in place increases XSS risk.

Evidence

• install_url_hijack manifest onInstalled opens https://gameograf.com/?p=32896?utm_source=extension&utm_medium=install — 3rd-party tracking.
• uninstall_url_hijack manifest setUninstallURL targets https://gameograf.com/?p=32896?utm_source=extension&utm_medium=uninstall.
• newtab_override manifest chrome_url_overrides.newtab set to newtab.html; search permission also declared — monetization surface.
• generic_privacy_policy store Privacy policy URL is Google's own policy (myaccount.google.com/privacypolicy); not scoped to this extension.
• dom_xss_sink crx calendar.js uses innerHTML from variable; no CSP present to mitigate DOM-XSS.
• no_developer_name store developer_name is empty string; reduces accountability despite verified_publisher flag.
• csp_absent_mv3 manifest content_security_policy is null; MV3 has strict defaults but no explicit CSP means no extra hardening.
• verified_publisher store verified_publisher=true via gameograf.com; domain resolves and is not throwaway — partial trust credit.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Son Goku Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.99 -> 7.49 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Can alter search provider behavior; concerning for a NewTab/wallpaper extension.
• alarms low Schedules background tasks; low standalone risk.
• storage low Local data persistence; low risk.
• chrome_url_overrides.newtab medium Replaces new-tab page; high visibility surface, monetization risk.
• host_permissions: https://api.gameograf.com/* medium Scoped to developer's own API; acceptable but all outbound data flows through it.

Pillar Scores

Bookkeeping