Top Risks

• Uninstall URL hijack to owhit.com — classic traffic-monetization signal.
• Install URL hijack to owhit.com — opens third-party page on install.
• Privacy policy is Google's generic policy; does not scope to this extension — effectively no policy.
• New-tab override with 'search' permission and free-webmail dev is a low-effort monetization shell pattern.
• 8 external JS hosts including OpenAI, Netflix, Instagram, YouTube, X — far beyond any stated wallpaper function.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL -> https://owhit.com/uninstall; classic monetization shell indicator.
• install_url_hijack manifest onInstalled opens https://owhit.com/incredibox-sprunki-fun-bot-live-wallpaper on install.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces new-tab page entirely.
• generic_privacy_policy store Privacy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_dev store Developer email pelins8391@gmail.com; numbered alias pattern; no verified business domain.
• broad_external_hosts crx js_external_hosts lists 8 domains (OpenAI, Netflix, Instagram, YouTube, X, owhit.com) unrelated to wallpaper.
• new_tab_monetization_shape manifest NewTab + search permission + owhit.com install/uninstall hooks = low-effort traffic-monetization cluster.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.

Permissions Breakdown

• search medium Search API can redirect or override default search behavior.
• chrome_url_overrides.newtab medium Replaces new-tab page; classic monetization surface for ad-injection.

Pillar Scores

Bookkeeping