Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Ferrari Formula 1 Car SF-24 Wallpapers New Tab by Gameograf [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy URL returns fetch error (unreachable); privacy pillar scores maximum 10.0.
• NewTab override + search permission = classic search-monetization shell; uninstall/install URL hijacks confirm tracking.
• No CSP on MV3 extension with innerHTML sink in popup.js — DOM-XSS risk.
• months_since_update=15 puts maintenance in 12-24mo stale band (+6.0); stale newtab shells are supply-chain targets.

Evidence

• privacy_policy_fetch_error api Privacy policy URL returned HTTPError at fetch time; treated as fetched==false → +10.0 privacy pillar.
• newtab_override_with_search manifest chrome_url_overrides.newtab + search permission: NewTab monetization shell pattern.
• uninstall_install_url_hijack crx Both onInstalled and uninstall redirect to gameograf.com UTM-tagged URLs — tracking lifecycle events.
• no_csp_with_innerhtml_sink crx csp_present==false AND dom_sink_innerhtml_userctrl in popup.js; DOM-XSS sink without policy guard.
• external_github_host crx mlionltd.github.io listed in js_external_hosts; third-party GitHub-hosted JS outside developer control.
• stale_update store months_since_update=15; falls in 12-24mo band (+6.0 maintenance). Stale newtab extensions are acquisition targets.
• verified_publisher_capped store Verified publisher discount capped at -1.0 per invariant 0c/0e: months_since_update>18? No(15), but monetization pattern applies.
• operator_cluster_dev_email_siblings api dev_email dimension shows 5 sibling extensions under support@gameograf.com; compound fingerprint sibling_count=0.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Ferrari Formula 1 Car SF-24 Wallpapers New Tab by Gameograf [adware] + malext.io malicious_extension_sentry; score 5.10 -> 7.60 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying the browser search API; combined with newtab override raises monetization concern.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; limited blast radius.
• chrome_url_overrides.newtab medium Replaces every new tab page; prime surface for ad/search monetization.

Pillar Scores

Operator Siblings (6)

Other extensions sharing this developer's compound fingerprint:

• pikefoaagadfjcgbhgdhdboefoohdpbe
• iofncbfmmdjkbalfhneppkeglboddgfl
• daaiminpbfdcmdacaomdnemceoillghm
• bdgjlkghndpkfhfhpdgeabcfnkjanagl
• gillmlaalielgmhgekhkolcbcjghaeki
• ediemaoaclggogobngcpcfdanoakkpga

Bookkeeping