Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — K-pop Demon Hunters Zoey Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection and third-party sharing: scores maximum privacy risk.
• NewTab override combined with search permission creates monetization surface on every new tab.
• Uninstall URL hijack to gameograf.com and install URL hijack to Stranger Things wallpaper — traffic harvesting pattern.
• Two innerHTML DOM-XSS sinks with no CSP present amplify injection risk.

Evidence

• privacy_policy_generic_google store Privacy policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension; data_collection+third_party_sharing true.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() targets gameograf.com with UTM tracking params — traffic monetization on removal.
• install_url_hijack crx onInstalled opens gameograf.com/stranger-things-5-live-wallpaper — unrelated promotional redirect on install.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html — replaces every new tab with extension-controlled page.
• dom_xss_sinks_no_csp crx Two innerHTML sinks in popup.js and calendar.js; csp_present=false amplifies DOM-XSS risk per FIX B.
• no_developer_name store developer_name is empty string — no 'Offered by' accountability signal.
• verified_publisher store verified_publisher=true for gameograf.com; domain resolves, not throwaway — mitigates reputation partially.
• newtab_search_combo manifest search permission + newtab override = classic ad-monetization shell pattern for wallpaper/NewTab category.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — K-pop Demon Hunters Zoey Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.27 -> 7.77 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows manipulation of the browser's search provider — medium monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; low risk if domain is legitimate.
• chrome_url_overrides.newtab medium Replaces new-tab page — primary monetization surface for this extension type.

Pillar Scores

Bookkeeping