Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Rilakkuma Wallpapers New Tab [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy (not scoped to this extension) admitting data collection and 3rd-party sharing — Privacy pillar 10.0.
• Uninstall and install URL hijacks redirect to gameograf.com with tracking params — monetization shell signals.
• NewTab override + bit.ly affiliate/cloaking link in JS external hosts.
• No content_security_policy (MV3 null CSP) with innerHTML DOM-XSS sink in popup.js.

Evidence

• uninstall_url_hijack manifest setUninstallURL to gameograf.com with UTM tracking; classic monetization shell pattern.
• install_url_hijack manifest onInstalled opens gameograf.com with UTM tracking params.
• privacy_policy_generic store Policy URL is Google's own account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• affiliate_hit_bit.ly crx bit.ly in js_external_hosts flagged as affiliate/cloaking redirector by threat_intel.
• newtab_override manifest chrome_url_overrides.newtab replaces every new tab; paired with search permission.
• dom_xss_sink crx innerHTML assigned from variable in js/popup.js; no CSP present, elevates DOM-XSS risk.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit restriction on connect-src.
• verified_publisher store verified_publisher=true for gameograf.com; discount capped due to months_since_update=16 approaching stale threshold.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Rilakkuma Wallpapers New Tab [adware] + malext.io malicious_extension_sentry; score 5.28 -> 7.78 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding or interacting with browser search; medium risk for a NewTab extension.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; low risk if domain is trusted.
• chrome_url_overrides.newtab medium Replaces every new tab page; primary mechanism for this extension category.

Pillar Scores

Bookkeeping