Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Ariana Grande Wallpapers Gameograf [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall URL hijack to gameograf.com tracking endpoint — confirmed traffic-monetization pattern.
• Install URL hijack to gameograf.com tracking endpoint — fires on every install.
• NewTab override with search override: ad-monetization shell pattern on every new tab.
• Privacy policy is an unfetchable Google account URL — not scoped to this extension at all.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → https://gameograf.com/?utm_source=uninstall; classic monetization/tracking redirect.
• install_url_hijack manifest onInstalled opens https://gameograf.com/?utm_source=install; 3rd-party URL on every install.
• newtab_override manifest chrome_url_overrides.newtab = index.html; controls every new tab opened by user.
• privacy_policy_fetch_failed api Policy URL is Google account page; fetched==false (SSLError); not extension-scoped. Privacy pillar = 10.0.
• dom_xss_sink crx js/popup.js: innerHTML assigned from variable without CSP — DOM-XSS risk.
• external_host_mlionltd_github_io crx JS loads from mlionltd.github.io — third-party GitHub Pages host, not developer-controlled domain.
• maintenance_gap store 16 months since last update; NewTab extension with monetization shape and no active maintenance.
• search_override_permission manifest search permission declared alongside newtab override — dual monetization surface.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Ariana Grande Wallpapers Gameograf [adware] + malext.io malicious_extension_sentry; score 5.61 -> 8.11 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding search provider; monetization vector for NewTab extensions.
• chrome_url_overrides.newtab medium Replaces new-tab page; high-traffic surface for ad/affiliate monetization.
• host_permissions: https://api.gameograf.com/* low Scoped to own API domain; limited blast radius.

Pillar Scores

Bookkeeping