Top Risks

• Uninstall URL hijack to owhit.com — tracks user churn for ad-tech monetization.
• Install URL hijack to owhit.com — sends install event to third-party on every install.
• New-tab override with search permission — classic monetization shell pattern.
• Privacy policy is Google's own policy, not scoped to this extension; admits data collection and third-party sharing.
• Free-webmail developer (numbered alias Gmail), no verified publisher, no business domain — unaccountable operator.

Evidence

• uninstall_url_hijack crx setUninstallURL → https://owhit.com/uninstall; third-party tracking on every uninstall.
• install_url_hijack crx onInstalled opens https://owhit.com/christmas-tree-forest-live-wallpaper; third-party install beacon.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces all new tabs with extension page.
• generic_privacy_policy store Policy URL is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true). D rule: +10.0.
• free_webmail_dev store Developer email cevatkaragoz92u3@gmail.com — numbered alias Gmail, no business domain, no verified publisher.
• js_external_hosts crx JS references 8 external hosts incl. owhit.com, openai.com, instagram, netflix, youtube, x.com — broad reach for wallpaper.
• search_permission_newtab_combo manifest search permission + newtab override = canonical monetization shell pattern per rubric (+2.0 webstore).
• csp_absent_mv3 manifest No explicit CSP declared (MV3 default enforced); no CVEs so no amplifier triggered.

Permissions Breakdown

• search medium Can manipulate search provider; paired with newtab override amplifies monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; high-reach monetization surface.

Pillar Scores

Bookkeeping