Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Rodeo Gaming [credential-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• webRequestBlocking + webrequest_redirect code: extension actively redirects user traffic in background.js.
• Privacy policy URL returns SSLError (unfetchable); no data handling disclosure available.
• Install and uninstall URL hijack both flagged; opens /index.html on install and sets uninstall redirect.
• No developer name; manifest uses localization placeholders only; opacity around identity.

Evidence

• webrequest_redirect in background.js crx code_findings_raw confirms active webRequest redirect handler intercepting URLs.
• privacy_policy fetch failed (SSLError) api privacy_policy_classification.fetched==false; policy URL has SSL error; treated as no policy.
• uninstall_url_hijack + install_url_hijack both true crx Extension opens /index.html on install and sets uninstall redirect; monetization shell pattern.
• host_permissions include chrome-extension://*/* manifest Broad access to all other installed extensions; unusual for Entertainment category.
• js_external_hosts: cloudapi.stream, react.dev crx Two external JS hosts referenced; cloudapi.stream is unknown third-party CDN.
• install_perm_anomaly: small_install_high_perm api 54 installs with HIGH-tier permissions (webRequest, webRequestBlocking); tail-attack surface.
• verified_publisher but no developer_name store Publisher verified via email domain origonews.com but no display name; opacity raises concern.
• manifest name/description are localization placeholders manifest manifest_name=__MSG_name__, manifest_description=__MSG_desc__; evasion or incomplete listing.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Rodeo Gaming [credential-theft] + malext.io malicious_extension_sentry; score 5.89 -> 8.39 (+2.5 cap 2.5).

Permissions Breakdown

• tabs medium Access to tab URLs and metadata; paired with webRequest adds URL surveillance capability.
• webRequest high Intercept all network requests; confirmed used for redirect in background.js.
• webRequestBlocking high Block/modify requests synchronously; enables traffic hijacking.
• chrome-extension://*/* medium Host access to all other extensions; unusual scope for a gaming extension.
• https://top.rodeo/* low Scoped host access to own domain; expected for extension backend.

Pillar Scores

Bookkeeping