Top Risks

• Uninstall AND install URL hijacked to chromewallpaper.com — classic monetization/redirect shell.
• NewTab override with 'search' permission creates full search-hijack surface on every new tab.
• Privacy policy is Google's generic account policy — does not scope to this extension at all (+10 privacy).
• Free-webmail developer (burakakkan420@gmail.com) with no verified business identity.
• No CSP declared; MV3 default mitigates eval but newtab shell with external JS hosts is still risky.

Evidence

• install_url_hijack crx onInstalled opens https://chromewallpaper.com/ — standard traffic-monetization install hook.
• uninstall_url_hijack crx setUninstallURL points to https://chromewallpaper.com/ — 3rd-party redirect on uninstall.
• newtab_override manifest chrome_url_overrides.newtab = index.html replaces every new tab; primary monetization surface.
• privacy_policy_generic store Policy URL is Google account policy (479 KB); scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email burakakkan420@gmail.com; no verified publisher, no business website.
• js_external_hosts crx 9 external hosts referenced incl. play.owhit.com, chromewallpaper.com alongside major platforms.
• search_permission_plus_newtab manifest 'search' permission + newtab override = full search hijack capability without broad host_permissions.
• maintenance_stale store 18 months since last update — on the boundary of the 6-point maintenance band.

Permissions Breakdown

• search medium Allows reading/modifying default search; paired with newtab override creates full search-hijack surface.
• chrome_url_overrides.newtab high Replaces every new-tab page with extension HTML; primary monetization/hijack vector for this category.

Pillar Scores

Bookkeeping