Top Risks

• Uninstall URL hijack to owhit.com — hard Webstore +3.0 signal for traffic monetization shell
• Install URL hijack to owhit.com — onInstalled opens third-party page, classic install monetization
• Privacy policy is Google's own policy (generic/unscoped) but admits data collection + third-party sharing — scores +10.0
• NewTab override with 'search' permission and 8 external JS hosts including owhit.com = ad-revenue funnel
• Free-webmail dev (gmail) with no verified publisher or business website; no business accountability

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL points to https://owhit.com/uninstall — third-party traffic monetization pattern.
• install_url_hijack crx onInstalled opens https://owhit.com/elden-ring-live-wallpaper — third-party install redirect.
• newtab_override manifest chrome_url_overrides.newtab set to index.html; combined with search permission = monetization shell.
• generic_privacy_policy store Policy URL is Google's own account policy — scope_extension=false, admits data collection and 3rd-party sharing.
• free_webmail_dev store Developer email ysaniye567@gmail.com; no verified publisher, no business domain, no accountability.
• js_external_hosts crx 8 external hosts in JS: owhit.com, chat.openai.com, instagram.com, netflix.com, youtube.com, x.com, etc.
• csp_absent manifest content_security_policy is null (MV3, so no v2 +2.0 penalty, but no protection either).
• new_tab_monetization_shape store NewTab + search override + install/uninstall hijack to owhit.com = textbook monetization shell pattern.

Permissions Breakdown

• search medium Allows overriding search provider; combined with newtab override this creates monetization surface.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary vehicle for ad/search monetization in shell patterns.

Pillar Scores

Bookkeeping