Top Risks

• Uninstall URL hijacked to owhit.com — classic monetization/tracking shell signal (+3.0 Webstore)
• Install URL hijacked to owhit.com — onInstalled opens 3rd-party page (+2.0 Webstore)
• Privacy policy is Google's generic account policy — does not scope to this extension (+10.0 Privacy)
• NewTab override with search permission = ad-monetization shape; free-webmail dev, no verified publisher
• 8 external JS hosts including social/streaming platforms; owhit.com operator domain is unverified

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL targets https://owhit.com/uninstall — 3rd-party operator domain.
• install_url_hijack crx onInstalled opens https://owhit.com/marin-kitagawa-wallpaper — 3rd-party operator page.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab for all users.
• privacy_policy_generic store Privacy URL is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true).
• free_webmail_developer store Developer email demorelmert101@gmail.com; no verified publisher; developer_name is generic 'Chrome Wallpaper'.
• external_hosts crx 8 JS external hosts: owhit.com, chatgpt.com, google.com, instagram.com, netflix.com, youtube.com, x.com, chrome.google.com.
• search_permission_plus_newtab manifest search permission combined with newtab override matches ad-monetization pattern for wallpaper shells.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP hardening declared.

Permissions Breakdown

• search medium Grants ability to interact with browser search; paired with newtab override raises monetization concern.
• chrome_url_overrides.newtab high Replaces every new tab page; primary vector for ad/search monetization in wallpaper shells.

Pillar Scores

Bookkeeping