Chrome Web Store
5Versions
1Code reviewed

No malware found

In code review (v3.50)

Our reviewer read version 3.50 — the most recent version we have reviewed — and found no malicious behaviour. The version shown here has not been individually reviewed yet.

What our analysis found

Kokushibo Demon Slayer Gameograf, used by 1,000 people, showed no malicious code in Extension Auditor's review. Our code review reported 1 finding (1 medium), led by phishing. It comes from a trusted publisher and was last updated in October 2026.

Key findings

  • Medium

    Phishing

    On every new tab the extension fetches a JSON blob from its own server and assigns the attacker-or-publisher-controlled `html` field directly into the new-tab document with no sanitisation; the Turkish comment on line 50 literally reads 'you must be sure the content is trustworthy', acknowledging the gap. The default MV3 CSP prevents script execution, so this is not remote code loading, but it still lets whoever controls [domain withheld] render arbitrary static markup (fake sign-in forms, spoofed browser or bank prompts, links) inside a page the user perceives as part of their browser, which is the classic delayed-monetisation channel for new-tab template farms. Because the rendered content is decided server-side after review, no static analysis of this bundle can bound what the extension eventually displays.

Analyst notes

Every file in the signed package is a plain new-tab wallpaper page plus self-contained local widgets (calculator, todo, timer, calendar, sticky notes, a Google-apps launcher, a ChatGPT link box); there is not a single POST, no usage, and no user data leaves the browser anywhere in the 12 JS files. The only three network calls are GETs to the publisher's own first-party origins ([domain withheld] at:49, [domain withheld] at:35, [domain withheld] at:17), all three matching features named in the listing, and chrome.search.query (:219) forwards only the user's typed string to their own default engine with no hijack. The missing 13th JS file,, was recovered from the stored CRX for version 3.50 and is byte-identical stock jQuery (87,533 bytes, sha256-, the SRI hash published by [domain withheld]), so no code hides there. What I cannot fully rule out is the server side::51 assigns server-supplied HTML straight into the new-tab DOM, so the shipped bundle's benignity is contingent on [domain withheld]; the default MV3 CSP (no content_security_policy override in the manifest) blocks script execution, inline handlers and javascript: URLs, which caps that channel at static markup, so I report it as a phishing surface rather than remote code loading. The chrome-stats impact and the low publisher-level malicious rate are consistent with this reading, while the malext-feed note is self-described as 'not an independent code review' and the 33% permhash cluster only reflects the ubiquitous search + one-host new-tab manifest shape, so neither adds evidence; the ML score is not corroborated by anything in the code.

Kokushibo Demon Slayer Gameograf

Kokushibo Demon Slayer Gameograf Chrome extension security report

ID: ojdhkbgnlljfhmebckgaambnchpcfoki

Supported Languages

🇺🇸English

Extension Info & Metadata

Status
Active
Version
3.51
Size
34.62 MB
Rating
4.0/5
Reviews
4
Users
1,000
Type
Extension
Updated
Oct 9, 2026
Category
Just for fun
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes
This publisherTrack record
1433extensions
393 no longer listed
Scanned by Extension Auditor — Low RiskDevelopers: embed this badge to link to this report.

Publisher Contextual Analysis

Trusted
Author
https://gameograf.com/
Country
US
Address
4557 De Silva St Fremont, CA 94538-2506 US
Website
Visit
Extensions
1433
Active
1039
Obsolete
393
Listed
1433
Unlisted
0
Users
942,050

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Screenshots & videos

Screenshot 1
Screenshot 2
Screenshot 3
Screenshot 4
Screenshot 5

Install growth

Item
Type
Severity
Description
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
https://api.gameograf.com/*
Host
Medium
Host permission — access limited to this URL pattern.
search
Permission
Low
This permission accesses search functionality. Rated Low because it only interacts with the browser's search feature without accessing search history.
alarms
Permission
Low
This permission schedules periodic tasks. Rated Low because it can only trigger events at specified times without access to sensitive data.

About this extension

Experience the haunting allure of Kokushibo with this HD live wallpaper that transforms your new tab into a demon’s realm.

Read the publisher’s full description

Kokushibo – Demon Slayer Live Wallpaper New Tab Step into the dark and formidable world of Demon Slayer with the Kokushibo Live Wallpaper. Each new tab opens with a striking HD video featuring Kokushibo in action, showcasing his menacing presence, intricate design, and intense anime-inspired combat. Perfect for Demon Slayer fans who want dramatic and visually powerful new tab experiences. Extension Features ⚔️ Kokushibo Video – Dynamic HD looped live wallpaper featuring Kokushibo from Demon Slayer. 📰 News Feed Bar – Stay updated with trending anime, gaming, K-pop, and entertainment news. 🔗 Popular Shortcuts – Quick access to YouTube, Netflix, ChatGPT, Amazon, and more. ➕ Custom Shortcuts – Add your favorite websites for instant access. 🔍 Search Bar – Works seamlessly with your default search engine. 🕒 Clock & Date – Minimalist, always-on time & date widget. 📝 Sticky Notes – Colorful, draggable notes on your new tab. 🔔 Notifications – Get alerts about new wallpapers & features. 📧 Google Apps – One-click access to Gmail, Maps, Drive, and more. 🤖 ChatGPT Widget – Ask questions and get instant AI-powered answers. ✅ To-Do List – Organize your daily tasks directly on your new tab. 📅 Calendar Tool – Keep track of important dates. 🧮 Calculator – Perform calculations without leaving Chrome. ⏳ Timer – Built-in countdown for productivity or breaks. 🛠 More Tools – Includes privacy settings, uninstall guide, and support. About Us Gameograf.com creates exclusive Chrome new tab extensions to make browsing more personalized and fun. Explore our vast library of anime & manga, K-pop, cars & bikes, sports, celebrities, and more unique themes designed for fans worldwide. 🌐 Website: https://gameograf.com 📩 Contact: https://gameograf.com/contact-us/ 🔒 Privacy Policy: https://gameograf.com/privacy-policy/ 💬 Feedback: https://gameograf.com/feedback/ 📧 Email: support@gameograf.com Affiliate Policy Notice When installed, this extension opens a new tab at https://gameograf.com , where you can explore similar themes and tutorials. Some links on our website may include affiliate partnerships, which means Gameograf.com may earn a small commission if you purchase through them. These commissions help us maintain and improve our free extensions.

User reviews

Extension files

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No network indicators were extracted from this version.

Version
Size
Verdict
Findings
Permhash
3.51
Latest
34.62 MBNot scanned—
343f287e6d12825df64c62a2be0f8588752dd1f55a775c3456f396a4d897ee24
3.0.0
43.33 MBNot scanned—
2419329067823cab5b4e5ac5dd18a6abf1f57f45e753f5fc934292f3085a3717
3.40.0
43.33 MBNot scanned—
2419329067823cab5b4e5ac5dd18a6abf1f57f45e753f5fc934292f3085a3717
3.50
43.40 MBNo malware found0
2419329067823cab5b4e5ac5dd18a6abf1f57f45e753f5fc934292f3085a3717
2.0.1
N/ANot scanned—N/A
Showing 1 to 5 of 10 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.