Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Kokushibo Demon Slayer Gameograf [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override + uninstall/install URL hijack: classic game-portal monetization shell pattern.
• Uninstall URL hijack redirects to gameograf.com with UTM tracking on every removal.
• Install URL hijack opens gameograf.com on every install — onboarding monetization.
• Two innerHTML DOM-XSS sinks (popup.js, calendar.js) with no CSP to mitigate exploitation.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL targets gameograf.com with UTM params — +3.0 Webstore.
• install_url_hijack crx onInstalled opens gameograf.com with UTM tracking — +2.0 Webstore.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; fan-theme shell pattern — +2.0 Webstore.
• dom_sink_innerhtml crx innerHTML sinks in popup.js and calendar.js; no CSP present — DOM-XSS risk.
• no_csp manifest content_security_policy is null; MV3 strict default applies but no explicit hardening.
• verified_publisher store Verified publisher badge present; applied -2.0 Reputation discount (capped per 0c: no stale/CVE/monetization triggers).
• privacy_policy_classification api Fetched, scoped, data_collection+retention+third_party_sharing all true — Privacy pillar +1.0.
• fan_content_shell store Anime character theme + NewTab override + install/uninstall hijack = fan-content/game-portal shell pattern.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Kokushibo Demon Slayer Gameograf [adware] + malext.io malicious_extension_sentry; score 4.06 -> 6.56 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows manipulation of browser search settings; paired with newtab override raises monetization risk.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; no broad host access.
• chrome_url_overrides.newtab medium Replaces new-tab page; standard monetization surface for fan-theme/game-portal shells.

Pillar Scores

Bookkeeping