Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Karol G Wallpapers New Tab [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy (scope_extension=false, data_collection=true, third_party_sharing=true): worst-case privacy disclosure.
• Uninstall and install URL hijack to gameograf.com — explicit monetization/tracking funnel on lifecycle events.
• NewTab override gives replacement of every new tab with no rating, 247 installs, and no developer name.
• Privacy policy points to Google's own policy, not an extension-scoped document — effectively no disclosure.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com with UTM params; explicit monetization on uninstall.
• install_url_hijack crx onInstalled opens gameograf.com with UTM params; tracks install events to 3rd party.
• privacy_policy_generic_google store Privacy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true.
• newtab_override manifest chrome_url_overrides.newtab=index.html; replaces every new tab session for all users.
• no_developer_name store developer_name is empty string despite verified_publisher=true.
• stale_extension store 16 months since last update; Maintenance pillar elevated.
• js_external_hosts_broad crx 10 external JS hosts including mlionltd.github.io, chatgpt.com, instagram.com, netflix.com, reddit.com.
• new_tab_with_search_permission manifest Search permission + NewTab override combo enables search monetization pattern.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Karol G Wallpapers New Tab [adware] + malext.io malicious_extension_sentry; score 5.74 -> 8.24 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/modifying search provider; relevant to NewTab monetization.
• chrome_url_overrides.newtab medium Replaces every new tab; high daily reach and typical monetization vector.

Pillar Scores

Bookkeeping