Top Risks

• Uninstall URL hijack to owhit.com and install URL hijack — classic traffic-monetization shell indicators.
• New-tab override with search permission: wallpaper shell pattern used to monetize search queries.
• Privacy policy is a generic Google account URL that failed to fetch (SSLError); no extension-scoped policy.
• Free-webmail developer (gmail) with no verified business; throwaway-style identity.
• 8 external JS hosts including social/media platforms injected into every new tab.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL targets https://owhit.com/uninstall — 3rd-party monetization domain.
• install_url_hijack crx onInstalled opens https://owhit.com/mustang-blue-live-wallpaper/ — 3rd-party redirect on install.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab with extension page.
• search_permission manifest search permission declared alongside newtab override — enables search monetization.
• privacy_policy_fetch_failed api Privacy policy URL is Google account page; fetch returned SSLError. No extension-scoped policy exists.
• free_webmail_dev store Developer email bisarozbey4@gmail.com — Gmail, no verified business, no confirmed domain.
• js_external_hosts crx 8 external hosts referenced: owhit.com, openai, youtube, netflix, instagram, x.com, google, chrome store.
• wallpaper_shell_pattern store 98 installs, 0 rating, wallpaper title masking newtab+search override — fan-content/theme shell fingerprint.

Permissions Breakdown

• search medium Allows overriding search provider; paired with newtab override is a monetization vector.
• chrome_url_overrides.newtab medium Replaces new-tab page — primary delivery mechanism for wallpaper shell / ad monetization.

Pillar Scores

Bookkeeping