Top Risks

• Uninstall URL hijack to owhit.com — hallmark of monetization/tracking shell extension.
• Install URL hijack to owhit.com — opens 3rd-party page on install, user tracking vector.
• NewTab override replaced with extension page; search permission enables query monetization.
• Privacy policy is Google's generic account policy, wholly unscoped to this extension's data practices.
• Free-webmail developer (fatmadone64@gmail.com) with no verifiable business identity or accountability.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → https://owhit.com/uninstall; classic monetization shell fingerprint.
• install_url_hijack manifest onInstalled opens https://owhit.com/jinbesan-live-wallpaper/; 3rd-party install redirect.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab served by extension.
• generic_privacy_policy store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension.
• free_webmail_developer store Developer email fatmadone64@gmail.com; no verified publisher, no business domain.
• js_external_hosts crx Extension contacts 8 external hosts incl. owhit.com, instagram.com, netflix.com, youtube.com, x.com.
• search_permission_newtab_combo manifest search permission + newtab override together enable silent search monetization on every new tab.
• no_csp crx content_security_policy is null; MV3 default applies but no explicit restriction on external connects.

Permissions Breakdown

• search medium Allows reading/manipulating search queries; combined with newtab override raises monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab with extension-controlled page; core vector for ad-monetization shells.

Pillar Scores

Bookkeeping