Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Pusheen and Friends Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's own policy (not extension-scoped), admits 3rd-party data sharing — scores maximum privacy risk.
• NewTab override with both install and uninstall URL hijacks pointing to gameograf.com UTM-tagged pages — monetization shell pattern.
• Two innerHTML DOM-XSS sinks with no CSP present; csp_present==false elevates each to +2.0 in code quality.
• No developer name provided; rating is 1.0; verified publisher discount partially offset by empty name field.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — NewTab replacement confirmed.
• uninstall_url_hijack crx setUninstallURL to https://gameograf.com/?utm_source=extension&utm_medium=install (3rd party).
• install_url_hijack crx onInstalled opens https://gameograf.com/?utm_source=pusheen&utm_medium=install.
• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• dom_xss_no_csp crx Two innerHTML sinks in popup.js and calendar.js; csp_present=false amplifies risk.
• verified_publisher store Verified publisher badge present; provides -3.0 reputation discount (capped by 0c checks).
• no_developer_name store developer_name is empty string — +1.0 reputation penalty.
• low_rating store Rating 1.0 with only 268 installs; very low user satisfaction signal.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Pusheen and Friends Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.71 -> 7.21 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying the browser search provider; medium risk for a NewTab override.
• host_permissions: https://api.gameograf.com/* medium Scoped to developer API; enables outbound data transmission to dev server.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary monetization/tracking surface for this extension type.

Pillar Scores

Bookkeeping