Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Satoru Gojo Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall URL hijack to owhit.com — classic monetization/tracking shell pattern.
• Install URL hijack to owhit.com — opens 3rd-party page on every install.
• Privacy policy is Google's generic policy, scoped to Google not this extension; data_collection+3rd_party_sharing admitted without extension-specific scope → maximum privacy penalty.
• NewTab override replaces every new tab; 8 external JS hosts (Netflix, YouTube, Instagram, X, ChatGPT) vastly exceed wallpaper function.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → https://owhit.com/uninstall; 4 siblings share this endpoint.
• install_url_hijack crx onInstalled opens https://owhit.com/satoru-gojo-wallpaper — 3rd-party redirect on every install.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab for all users.
• generic_privacy_policy store Policy URL is Google's own account policy — scope_extension=false, data_collection=true, third_party_sharing=true.
• external_js_hosts crx 8 external hosts: chatgpt.com, netflix.com, instagram.com, x.com, youtube.com, owhit.com — excessive for a wallpaper.
• verified_publisher store verified_publisher=true, domain walltab.com resolves, age 3989 days — reduces reputation risk moderately.
• no_developer_name store developer_name is empty string; +1.0 reputation penalty applied.
• cve_findings_raw_empty crx No CVEs found; jquery 3.7.1 is current and clean. CVE pillar = 0.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Satoru Gojo Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.78 -> 7.28 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/modifying search provider; medium risk on its own but pairs with newtab override.
• chrome_url_overrides.newtab high Replaces every new tab — high-reach monetization surface; scored as MEDIUM (+1.0) + newtab-override (+2.0).

Pillar Scores

Bookkeeping