Top Risks

• Uninstall AND install URL hijack to owhit.com — classic monetization shell fingerprint.
• Privacy policy is Google account policy (unfetchable, unscoped) — effectively no policy for this extension.
• NewTab override + 'search' permission routes every new tab through owhit.com operator infrastructure.
• Free-webmail dev (gmail) with no verified business domain; unverifiable identity.
• 7 external JS hosts (chatgpt.com, instagram, youtube, x.com, owhit.com) indicate traffic-monetization aggregator.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → https://owhit.com/uninstall (3rd-party redirect on removal).
• install_url_hijack manifest onInstalled opens https://owhit.com/yoichi-isagi-wallpaper (3rd-party URL on install).
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab served by extension backed by owhit.com.
• privacy_policy_unfetched api Policy URL is Google account policy; fetch failed SSLError; scope_extension=false, data_collection=false.
• free_webmail_developer store Developer email yilmaztuna934@gmail.com — free webmail, no verified business domain.
• js_external_hosts crx 7 external hosts: owhit.com, chatgpt.com, instagram, youtube, x.com — wide monetization surface.
• new_tab_monetization_shape store Anime wallpaper shell + newtab override + search permission + owhit.com backend = traffic-monetization pattern.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP declared.

Permissions Breakdown

• search medium Allows reading/manipulating search queries; elevated risk paired with newtab override.
• chrome_url_overrides.newtab high Replaces every new tab — high-reach monetization surface with owhit.com backend.

Pillar Scores

Bookkeeping