Top Risks

• Uninstall URL hijack to owhit.com — behavioral monetization/tracking signal after removal.
• Install URL hijack to owhit.com — third-party notified on every install; affiliate/monetization shell.
• Privacy policy is Google's generic account policy (scope_extension==false, admits data collection and 3rd-party sharing) — worst-case privacy disclosure.
• NewTab override + search permission + free-webmail dev (gmail) with no verified identity — classic monetization shell pattern.
• JS contacts 8 external hosts (Netflix, Instagram, YouTube, X, OpenAI, etc.) from a wallpaper extension — unexplained broad reach.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL -> https://owhit.com/uninstall; third-party tracking on uninstall.
• install_url_hijack manifest onInstalled opens https://owhit.com/peppa-pig-forest-live-wallpaper; affiliate/monetization notification.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab replaced by extension.
• privacy_policy_generic store Policy is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• developer_identity store Free webmail gmail dev, no verified publisher, developer_name='Newtab' — no accountable entity.
• js_external_hosts crx 8 external hosts including chat.openai.com, netflix.com, instagram.com, x.com — unexplained for a wallpaper.
• csp_absent manifest content_security_policy is null; no CSP on MV3 extension with 8 external JS hosts.
• low_installs store Only 360 installs; tail-attack-surface concern if permissions/hooks scale to more users.

Permissions Breakdown

• search medium Can interact with search engine behavior; paired with NewTab override, enables search monetization.
• chrome_url_overrides.newtab medium Replaces every new tab with extension page; high-reach surface for monetization and data capture.

Pillar Scores

Bookkeeping