Top Risks

• Uninstall URL hijack to owhit.com — classic monetization-shell fingerprint on a trivial calendar wallpaper.
• Install URL hijack also redirects to owhit.com; both hooks confirm traffic-monetization pattern.
• NewTab override gives extension control over every new tab opened by the user.
• Privacy policy is Google's generic account policy — completely unscoped to this extension; admits collection+3rd-party sharing.
• Free-webmail developer (gmail), name 'playgames', no verified identity; accountability is near-zero.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → https://owhit.com/uninstall; 3rd-party traffic capture on removal.
• install_url_hijack crx onInstalled opens https://owhit.com/october-2026-calendar-wallpaper; 3rd-party redirect on install.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab for 240 users.
• generic_privacy_policy store Policy URL is Google account policy (479 KB), scope_extension=false, admits data_collection+third_party_sharing.
• free_webmail_dev store Developer email yakupogluokul@gmail.com; developer name 'playgames'; no verified publisher.
• js_external_hosts crx References chatgpt.com, instagram.com, x.com, youtube.com, owhit.com — broad unrelated host list for a wallpaper.
• search_permission_plus_newtab manifest 'search' permission combined with newtab override is a known search-monetization pattern.
• no_csp manifest content_security_policy is null; MV3 provides strict default but no explicit policy declared.

Permissions Breakdown

• search medium Allows reading/modifying search queries; paired with newtab override amplifies monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab; high-reach monetization surface on a calendar/wallpaper shell.

Pillar Scores

Bookkeeping