Top Risks

• NewTab override hijacks every new tab; uninstall+install URL both redirect to owhit.com (monetization shell pattern).
• Privacy policy is Google's own account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Free-webmail dev (dostkayalar@gmail.com), no verified publisher, no business website — identity unverifiable.
• 5 sibling extensions share the same uninstall-URL domain (owhit.com), indicating an organised wallpaper-shell operator.
• External JS hosts include chat.openai.com, Netflix, Instagram, YouTube, X.com — far beyond stated wallpaper function.

Evidence

• uninstall_url_hijack manifest setUninstallURL → https://owhit.com/uninstall; +3.0 Webstore (3rd-party uninstall hijack).
• install_url_hijack manifest onInstalled opens https://owhit.com/tung-tung-tung-sahur-live-wallpaper; +2.0 Webstore.
• newtab_override manifest chrome_url_overrides.newtab=index.html replaces every new tab; +2.0 Webstore monetization shape.
• operator_cluster_uninstall_url api 5 siblings share owhit.com uninstall URL; indicates organised shell operator despite sibling_count=0 by compound key.
• privacy_policy_generic store Policy is Google account privacy page: scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy (v3.5-D).
• free_webmail_dev store dostkayalar@gmail.com, no verified publisher, no business domain → Reputation floor 7.5.
• js_external_hosts_mismatch crx 8 external hosts including Netflix, Instagram, YouTube, X.com — far exceeds wallpaper/newtab purpose.
• no_csp manifest csp_present=false on MV3; +2.0 Network (MV2 rule N/A but no CSP increases injection surface).

Permissions Breakdown

• search medium Allows reading/manipulating search queries; medium risk on its own.
• chrome_url_overrides.newtab high Replaces every new tab; primary monetization vector for wallpaper shells.

Pillar Scores

Bookkeeping