Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Invincible Transformation Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall URL hijack to owhit.com — classic traffic-monetization shell fingerprint.
• Install URL hijack to owhit.com — redirects user on install to third-party site.
• Privacy policy is Google's own policy, not scoped to this extension; classified as data_collection+third_party_sharing without extension scope — worst-case privacy signal.
• NewTab override + search permission enables full replacement of browser search behavior for ad-revenue interception.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → https://owhit.com/uninstall; owhit.com is a third-party monetization domain.
• install_url_hijack crx onInstalled opens https://owhit.com/invincible-transformation-live-wallpaper/ — traffic harvesting on install.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab replaced, paired with search permission.
• privacy_policy_generic store Policy URL is Google Account privacy page, scope_extension=false, data_collection=true, third_party_sharing=true.
• developer_identity store Developer name == email (info@walltab.com); no verified publisher badge, no featured badge.
• js_external_hosts crx Extension references 8 external hosts incl. owhit.com, chat.openai.com, instagram.com, netflix.com, x.com.
• newtab_monetization_pattern store NewTab + uninstall-hijack + install-hijack + search permission = monetization shell cluster.
• cve_findings crx jquery 3.7.1 bundled; no CVEs in cve_findings_raw. CVE pillar = 0.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Invincible Transformation Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.41 -> 7.91 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows querying browser search engine; combined with NewTab override enables monetizable search interception.
• chrome_url_overrides.newtab high Replaces every new tab page — high-reach surface for ad injection and search monetization.

Pillar Scores

Bookkeeping