Top Risks

• Uninstall URL hijack to owhit.com — classic monetization/tracking shell pattern.
• Install URL hijack to owhit.com — tracks installs via third-party domain on every install event.
• Newtab override replaces every new tab with extension-controlled page; combined with 'search' permission enables search-monetization.
• Privacy policy is Google's own account policy — no scope to this extension; policy admits data collection and third-party sharing (v3.5 D rule: +10.0).
• Free-webmail dev (gmail), no developer name, no verified publisher — no accountability chain.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL targets https://owhit.com/uninstall — third-party uninstall tracking.
• install_url_hijack manifest onInstalled opens https://owhit.com/winter-wallpaper — third-party install tracking.
• newtab_override manifest chrome_url_overrides.newtab set to index.html — controls every new tab.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — v3.5 D: +10.0.
• developer_identity store Gmail dev email, no developer name, no verified publisher, no business domain.
• js_external_hosts crx 8 external hosts referenced: owhit.com, chatgpt.com, instagram.com, netflix.com, youtube.com, x.com, google.com, chrome.google.com.
• new_tab_monetization_pattern manifest NewTab override + search permission + uninstall/install hijack to owhit.com = monetization shell pattern.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.

Permissions Breakdown

• search medium Allows search provider interaction; medium risk on its own but paired with newtab override amplifies concern.
• chrome_url_overrides.newtab high Hijacks every new tab page; high visibility surface enabling ad injection and search monetization.

Pillar Scores

Bookkeeping