Top Risks

• NewTab override + search permission = full search hijack surface operated from free-webmail identity.
• Uninstall URL hijack to owhit.com — classic monetization-shell post-removal tracking.
• Install URL hijack to owhit.com — opens 3rd-party page on every install for ad/affiliate revenue.
• Privacy policy is Google's generic account policy, not scoped to this extension; admits data collection and 3rd-party sharing.
• Free-webmail developer (gmail), no verified publisher, no business domain — low accountability.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → https://owhit.com/uninstall; textbook monetization-shell signal.
• install_url_hijack manifest onInstalled opens https://owhit.com/sakamoto-days-wallpaper; opens 3rd-party page on every install.
• newtab_override manifest chrome_url_overrides.newtab = index.html replaces every new tab; search permission enables provider swap.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google account policy, not scoped to this extension.
• privacy_policy_classification api scope_extension=false, data_collection=true, third_party_sharing=true → D(iv) generic+admits sharing → +10.0.
• free_webmail_developer store Developer email kaansefa83@gmail.com; no verified publisher badge; no business domain.
• js_external_hosts crx 7 external hosts in JS: owhit.com, chatgpt.com, instagram.com, x.com, youtube.com — broad linkout cluster.
• new_tab_monetization_shape manifest NewTab + search + install/uninstall URL hijack to owhit.com = canonical traffic-monetization shell pattern.

Permissions Breakdown

• search medium Can manipulate search provider; combined with newtab override enables full search hijack.
• chrome_url_overrides.newtab high Replaces every new tab; prime real estate for ad monetization and search hijacking.

Pillar Scores

Bookkeeping