Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Giyu Tomioka Demon Slayer Gameograf [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override with uninstall URL hijack and install URL hijack — classic monetization shell pattern.
• No CSP (csp_present=false) on MV3 extension with innerHTML DOM-XSS sinks in popup.js and calendar.js.
• No developer name listed; verified publisher but developer_name is empty.
• search permission combined with newtab override creates search-provider manipulation surface.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL to gameograf.com with UTM tracking params — monetization signal.
• install_url_hijack manifest onInstalled opens gameograf.com with UTM params — monetization shell pattern.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html — replaces new-tab page, monetization surface.
• no_csp crx content_security_policy is null; MV3 default CSP applies but no explicit restriction declared.
• dom_xss_sink crx dom_sink_innerhtml_userctrl in popup.js and calendar.js — DOM-XSS risk without CSP.
• verified_publisher store Verified publisher badge present; developer domain resolves, no throwaway flag.
• privacy_policy_scope api Privacy policy fetched, scoped to extension, discloses collection, retention, and third-party sharing.
• search_permission_newtab_combo manifest search permission + newtab override together enable search provider manipulation.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Giyu Tomioka Demon Slayer Gameograf [adware] + malext.io malicious_extension_sentry; score 3.13 -> 5.63 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding search provider; medium risk for search hijacking.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain only.
• chrome_url_overrides.newtab medium Replaces new-tab page; monetization surface, user experience override.

Pillar Scores

Bookkeeping