Top Risks

• NewTab override + uninstall URL hijack to owhit.com signals ad-monetization shell pattern
• Install URL hijack on onInstalled opens 3rd-party owhit.com — classic traffic-monetization fingerprint
• Privacy policy is Google's own account policy (fetch failed / not scoped to extension) — effectively no policy
• Free-webmail developer (gmail) with no verified publisher or business website
• 8 external JS hosts spanning YouTube, Netflix, Instagram, X, OpenAI — excessive for a wallpaper/NewTab

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → https://owhit.com/uninstall; classic monetization-shell signal (+3.0 Webstore)
• install_url_hijack manifest onInstalled opens https://owhit.com/homer-simpson-live-wallpaper; traffic redirect on install (+2.0 Webstore)
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab page (+2.0 Webstore, +high Permissions)
• privacy_policy_fetch_failed crx Policy URL is Google account policy; fetch failed SSLError; not scoped to extension → Privacy +10.0
• free_webmail_dev store Developer email nermincandas@gmail.com; no verified publisher, no business domain → Reputation floor 7.5
• excessive_external_hosts crx 8 JS external hosts: owhit.com, YouTube, Netflix, Instagram, X, OpenAI, Google, chrome.google.com
• newtab_monetization_shape manifest NewTab + uninstall/install hijack + owhit.com hub = textbook low-effort traffic-monetization cluster
• cve_findings_empty crx No CVEs found; jquery 3.7.1 is current and patched. CVE pillar = 0.0

Permissions Breakdown

• search medium Allows querying search providers; medium risk for a NewTab override extension.
• chrome_url_overrides.newtab high Replaces every new tab with extension-controlled page; prime real estate for ad monetization.

Pillar Scores

Bookkeeping