Top Risks

• Uninstall URL hijack to owhit.com — classic monetization shell telemetry/redirect pattern.
• Install URL hijack to owhit.com — opens 3rd-party page on install, ad-traffic injection.
• Privacy policy fetch failed (SSLError on Google account policy URL) — no scoped policy exists.
• NewTab override + search permission on a fan-wallpaper with free-webmail dev and no verified publisher.
• Free-webmail developer (gmail) with no business domain; developer identity unverifiable.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → https://owhit.com/uninstall; 3rd-party monetization redirect.
• install_url_hijack manifest onInstalled opens https://owhit.com/harry-styles-wallpaper; ad-traffic injection on install.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces new-tab for wallpaper/monetization shell.
• privacy_policy_fetch_failed api Policy URL is Google account policy (not extension-scoped); fetch returned SSLError — treated as no policy.
• free_webmail_developer store Developer email canb08898@gmail.com; numbered-alias pattern; no business domain verifiable.
• js_external_hosts crx Extension references 7 external hosts incl. owhit.com, chatgpt.com, instagram.com, x.com, youtube.com.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening declared.
• fan_content_shell store Harry Styles wallpaper theme with newtab+search override and owhit.com uninstall/install hooks.

Permissions Breakdown

• search medium Allows overriding default search provider; paired with newtab override typical of monetization shell.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary vector for ad/affiliate monetization in fan-content shells.

Pillar Scores

Bookkeeping