Top Risks

• Uninstall URL hijack to owhit.com and install URL hijack — classic monetization shell pattern (+3.0 each in webstore).
• NewTab override replaces every new tab; combined with 'search' permission creates search-monetization surface.
• Privacy policy is Google's generic account policy — does not scope to this extension; data_collection+third_party_sharing admitted without scope → +10.0 privacy.
• Free-webmail developer (gmail) with no verified identity; no business website; dev name 'MotionWalls' unverifiable.
• js_external_hosts includes owhit.com, chat.openai.com, Netflix, Instagram, YouTube, X — far beyond a wallpaper newtab's stated function.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → https://owhit.com/uninstall (+3.0 webstore).
• install_url_hijack manifest onInstalled opens https://owhit.com/gojo-and-kitty-jujutsu-kaisen-live-wallpaper (+2.0 webstore).
• newtab_override manifest chrome_url_overrides.newtab=index.html; replaces every new-tab page (+2.0 webstore, high perm).
• search_permission manifest 'search' permission declared alongside newtab override — search monetization vector.
• privacy_policy_generic store Policy is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (v3.5-D).
• free_webmail_dev store Developer kaansefa83@gmail.com; no verified publisher; no business domain; floor reputation ≥7.5.
• js_external_hosts_mismatch crx 8 external hosts (owhit.com, Netflix, Instagram, YouTube, X, ChatGPT) — far exceeds wallpaper stated function.
• no_csp manifest content_security_policy null on MV3; MV3 has strict default so no v2 +2.0 network penalty applied.

Permissions Breakdown

• search medium Allows reading and potentially influencing search queries; paired with newtab override raises monetization concern.
• chrome_url_overrides.newtab high Replaces every new-tab page; primary vector for ad-monetization and search hijacking.

Pillar Scores

Bookkeeping