Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Rose Newest Photos Wallpaper by Gameograf [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall and install URL hijack to gameograf.com — classic monetization shell pattern.
• New-tab override with search permission — ad-monetization surface on every new tab.
• bit.ly affiliate/cloaking link in js_external_hosts — opaque redirect destination.
• mlionltd.github.io external JS host — uncontrolled third-party CDN loading risk.

Evidence

• install_url_hijack + uninstall_url_hijack manifest Both install and uninstall events open gameograf.com with UTM params — monetization shell pattern.
• newtab_override manifest chrome_url_overrides.newtab replaces new-tab page; combined with search permission = ad monetization.
• affiliate_hit: bit.ly crx bit.ly in js_external_hosts — generic short-link redirector used for affiliate/cloaking.
• external_host: mlionltd.github.io crx GitHub Pages host not under developer's domain; third-party JS load risk.
• dom_sink_innerhtml_userctrl crx popup.js assigns innerHTML from variable without visible sanitization — DOM-XSS sink.
• verified_publisher store Gameograf is a verified publisher; discount applied but capped per monetization presence (v3.5E).
• privacy_policy_classification api Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true.
• maintenance_stale store 16 months since last update — falls in 12-24mo band (+6.0 maintenance).
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Rose Newest Photos Wallpaper by Gameograf [adware] + malext.io malicious_extension_sentry; score 4.27 -> 6.77 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding search behavior; combined with newtab override amplifies monetization risk.
• host_permission: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary vector for monetization and search redirect.

Pillar Scores

Bookkeeping