Top Risks

• Uninstall URL hijack to owhit.com — classic NewTab monetization shell exfiltrating uninstall events to 3rd party.
• Install URL hijack to owhit.com — redirects on install, data broker/monetization pattern.
• Privacy policy is Google's generic account policy, not scoped to this extension; admits data collection and 3rd-party sharing.
• NewTab override + search permission with free-webmail Gmail developer and no developer name — low accountability.
• 8 external JS hosts including Netflix, Instagram, YouTube, X, ChatGpt contacted from a wallpaper extension — scope mismatch.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL -> https://owhit.com/uninstall; 3rd-party monetization/tracking endpoint.
• install_url_hijack crx onInstalled opens https://owhit.com/ferrari-f1-car-wallpaper; classic NewTab shell install redirect.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new-tab for all 2,000 users.
• privacy_policy_generic store Policy URL is Google account policy (479KB); scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_no_dev_name store Developer email tekbatuhan64@gmail.com; developer_name empty; no business identity.
• external_js_hosts_mismatch crx 8 JS external hosts (Netflix, Instagram, YouTube, X, ChatGPT, owhit.com) in a wallpaper/NewTab extension.
• verified_publisher_with_monetization store verified_publisher=true but owhit.com install/uninstall hooks indicate monetization shell; 0c cap applies.
• csp_absent manifest content_security_policy is null/csp_present=false on MV3 extension; +2.0 Network per v2 calibration.

Permissions Breakdown

• search medium Allows manipulation of browser search provider; paired with newtab override elevates risk.
• chrome_url_overrides.newtab high Replaces every new-tab page; high reach monetization surface, especially with search permission.

Pillar Scores

Bookkeeping