Netskope Extension Risk

Detail view · rubric v3.6
← Back to catalog

Jimin 지민 Wallpapers by Gameograf

pkfpfefcdphljgemiemnbfalkdjlpmpd
Risk Score
7.09
Risk Level: High
Recommendation: 🟠 HIGH RISK — review
Category NewTab
Installs 548
Rating 5.0
Last updated 2025-03-26 (18 months ago)
Manifest version MV3
CSP present ❌ no
Developer info@gameograf.com
Verified publisher ✅ yes
Featured by Google ❌ no
Privacy policy link
Web Store open ↗

Top Risks

  • THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Jimin 지민 Wallpapers by Gameograf [adware] + malext.io malicious_extension_sentry (+2.5, capped).
  • NewTab override with uninstall URL hijack and install URL hijack: classic traffic-monetization shell pattern.
  • 9 moderate CVEs across jquery@1.9.1, jquery@3.4.1, and jquery-ui@1.12.1 (XSS); none fixed in bundled versions.
  • MV3 but no CSP declared; jquery<3.5 + no CSP triggers code-quality amplifier.
  • topSites permission exposes browsing habits; combined with NewTab override raises profiling risk.

Evidence

  • newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab page.
  • uninstall_url_hijack crx setUninstallURL targets gameograf.com with UTM params — traffic-monetization signal.
  • cve_moderate_bulk crx 9 moderate CVEs: jquery-ui@1.12.1 (4 XSS), jquery@3.4.1 (2 XSS), jquery@1.9.1 (3 XSS). All unfixed.
  • no_csp manifest content_security_policy is null; MV3 default CSP applies but no explicit hardening.
  • verified_publisher store verified_publisher=true; -2.0 reputation discount applied but capped at -1.0 (months=18, CVEs present).
  • stale_libraries crx jquery@1.9.1 bundled in bootstrap.min.js — extremely outdated, fixed_in 1.12.2/3.5.0.
  • js_external_hosts crx 12 external JS hosts including crazycraftz.com, jqueryui.com, pinterest.com; geo diversity CA+US.
  • triple_stale_fingerprint crx months_since_update=18 + CVEs present + MV2-era bundled libs; +2.0 webstore triple-stale signal.
  • threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Jimin 지민 Wallpapers by Gameograf [adware] + malext.io malicious_extension_sentry; score 4.59 -> 7.09 (+2.5 cap 2.5).

CVE Exposures (9)

CVELibrarySeverity Fixed inSummary
CVE-2021-41182 jquery-ui@1.12.1 moderate 1.13.0 XSS in the `altField` option of the Datepicker widget in jquery-ui
CVE-2021-41184 jquery-ui@1.12.1 moderate 1.13.0 XSS in the `of` option of the `.position()` util in jquery-ui
CVE-2022-31160 jquery-ui@1.12.1 moderate 1.13.2 jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like in
CVE-2021-41183 jquery-ui@1.12.1 moderate 1.13.0 XSS in `*Text` options of the Datepicker widget in jquery-ui
CVE-2020-11022 jquery@3.4.1 moderate 3.5.0 Potential XSS vulnerability in jQuery
CVE-2020-11023 jquery@3.4.1 moderate 3.5.0 Potential XSS vulnerability in jQuery
CVE-2019-11358 jquery@1.9.1 moderate 3.4.0 XSS in jQuery as used in Drupal, Backdrop CMS, and other products
CVE-2020-11023 jquery@1.9.1 moderate 3.5.0 Potential XSS vulnerability in jQuery
CVE-2015-9251 jquery@1.9.1 moderate 1.12.2 Cross-Site Scripting (XSS) in jquery

Permissions Breakdown

  • search medium Access to search engine info; relevant for NewTab but adds surface area.
  • topSites medium Reads user's most visited sites; privacy-relevant browsing data.
  • unlimitedStorage low No cap on local storage; low direct harm but enables large data caching.
  • storage low Standard local storage; low risk in isolation.
  • chrome_url_overrides.newtab medium Replaces every new tab; persistent user-facing surface for monetization or phishing.

Pillar Scores

Permissions3.50
Reputation3.50
Network3.00
Webstore7.00
Maintenance6.00
Privacy1.00
Code Quality2.00
CVE Exposure5.50

Bookkeeping

Rubric v3.6
Scored at 2026-11-03 09:52
Listing SHA cf83599d66de…
Force block — not fired
Score recovered no
Elapsed —