Top Risks

• NewTab override hijacks every new tab; paired with search permission enables search-provider manipulation.
• Uninstall URL hijack to owhit.com and install URL hijack: strong monetization-shell fingerprint.
• Privacy policy is Google's generic account policy — does not scope to this extension at all (scope_extension=false, data_collection=true, third_party_sharing=true): +10.0 privacy.
• Free-webmail developer (gmail) with no verified publisher badge and no business website.
• Extension contacts 8 external hosts (owhit.com, major platforms) with no CSP declared.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab with extension page.
• uninstall_url_hijack crx setUninstallURL target: https://owhit.com/uninstall — 3rd-party domain.
• install_url_hijack crx onInstalled opens https://owhit.com/goku-dragon-ball-live-wallpaper — 3rd-party domain.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_dev store Developer email bisarozbey4@gmail.com; no verified publisher; no business domain.
• external_hosts crx 8 external JS hosts including owhit.com, instagram, netflix, youtube, x.com, openai.
• no_csp manifest content_security_policy is null; MV3 strict default applies but no explicit CSP declared.
• search_permission_newtab manifest search permission + newtab override combo enables search monetization without webRequest.

Permissions Breakdown

• search medium Can override or query search behavior; medium risk when paired with NewTab override.
• chrome_url_overrides.newtab high Replaces every new tab with extension-controlled page; high monetization/exfil surface.

Pillar Scores

Bookkeeping