Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Kuromi Love Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall URL hijack to owhit.com — classic traffic-monetization shell pattern
• Install URL hijack to owhit.com — opens 3rd-party page on install
• Privacy policy is Google's own policy, not scoped to this extension; admits data collection & 3rd-party sharing
• New-tab override with 'search' permission enables search-redirect monetization

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL -> https://owhit.com/uninstall; textbook monetization shell.
• install_url_hijack manifest onInstalled opens https://owhit.com/kuromi-love-live-wallpaper/ — 3rd-party site.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new-tab with developer-controlled page.
• privacy_policy_generic store Policy is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true). +10.0 privacy.
• free_webmail_dev store Developer email nermincandas@gmail.com; no verified publisher; no business website.
• js_external_hosts crx Links to chat.openai.com, instagram.com, netflix.com, youtube.com, x.com, owhit.com — traffic aggregator shape.
• search_permission_plus_newtab manifest 'search' permission + newtab override enables silent search-provider manipulation.
• new_tab_monetization_pattern store Wallpaper/theme shell with newtab+search+uninstall hijack matches known ad-monetization fingerprint.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Kuromi Love Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.39 -> 7.89 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/modifying search queries; paired with newtab override amplifies search-hijack risk.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary surface for ad-monetization and search redirect.

Pillar Scores

Bookkeeping