Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Red Goku Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall URL hijack to haberikra.com with UTM tracking — monetization shell pattern.
• Install URL hijack to gameograf.com opens 3rd-party URL on install.
• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• NewTab override combined with search permission and 9 external JS hosts including social/streaming sites.

Evidence

• uninstall_url_hijack crx Uninstall URL redirects to haberikra.com with UTM params — classic monetization shell uninstall tracking.
• install_url_hijack crx Install URL opens gameograf.com with UTM params on extension install.
• newtab_override manifest chrome_url_overrides.newtab set to index.html — captures every new tab.
• privacy_policy_generic store Policy is Google's own privacy page (myaccount.google.com/privacypolicy) — not scoped to extension; data_collection=true, third_party_sharing=true.
• stale_extension store 21 months since last update; only 72 installs, zero ratings.
• external_js_hosts crx 9 external hosts including chatgpt.com, instagram.com, netflix.com, x.com, youtube.com — broad reach for a wallpaper.
• no_developer_name store developer_name is empty string; reduces accountability.
• verified_publisher store Verified publisher badge present (info@gameograf.com / gameograf.com resolves), provides partial accountability.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Red Goku Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.33 -> 7.83 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Search permission can influence search behavior; medium risk on its own.
• chrome_url_overrides.newtab medium Replaces new-tab page; high monetization potential, captures every new tab open.

Pillar Scores

Bookkeeping