Top Risks

• Uninstall URL hijacked to owhit.com — classic NewTab monetization shell pattern.
• Install URL hijacked to owhit.com — tracks installs and exposes users to 3rd-party landing page.
• Privacy policy is Google's own policy, not scoped to this extension; admits data collection and 3rd-party sharing.
• NewTab override with gmail-only developer identity and no verified publisher — unaccountable operator.
• External JS contacts 7 unrelated domains (Instagram, YouTube, X, ChatGPT, owhit.com) — unexplained reach.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL targets https://owhit.com/uninstall — 3rd-party uninstall tracking.
• install_url_hijack manifest onInstalled opens https://owhit.com/windows-11-stock-wallpaper — 3rd-party install tracking.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab controlled by extension.
• privacy_policy_generic store PP is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true) — not extension-specific.
• gmail_dev_no_verified_publisher store Developer email evrenturhane3@gmail.com; free webmail, no verified publisher badge.
• js_external_hosts_broad crx 7 external JS hosts: chatgpt.com, owhit.com, instagram.com, youtube.com, x.com — unexplained for a wallpaper extension.
• search_permission_newtab_combo manifest search permission + newtab override = standard search-monetization cluster.
• no_csp crx content_security_policy is null; MV3 default applies but no explicit hardening declared.

Permissions Breakdown

• search medium Allows querying browser search engine; combined with newtab override creates search monetization surface.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; high-reach monetization vector.

Pillar Scores

Bookkeeping