Top Risks

• Uninstall URL hijacked to owhit.com — classic monetization/tracking shell pattern (+3.0 Webstore).
• Install URL hijacked to owhit.com — opens 3rd-party page on install (+2.0 Webstore).
• Privacy policy is Google's generic account policy, not scoped to this extension; data_collection+third_party_sharing admitted → +10.0 Privacy.
• Free-webmail dev (gmail), no developer name, no verified publisher → Reputation floor 7.5.
• NewTab override + search permission enables full search monetization; contacts 8 external hosts including Netflix, Instagram, YouTube, X.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL -> https://owhit.com/uninstall; 3rd-party domain confirms monetization shell.
• install_url_hijack crx onInstalled opens https://owhit.com/death-note-wallpaper; 3rd-party URL hijack.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab page.
• privacy_policy_generic store Policy URL is Google's account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0.
• free_webmail_no_devname store developer_email=servetyahya06@gmail.com, developer_name empty, no verified publisher → Reputation 7.5 floor.
• js_external_hosts crx 8 external hosts: chatgpt.com, chrome.google.com, owhit.com, google.com, instagram.com, netflix.com, youtube.com, x.com.
• search_permission_plus_newtab manifest search permission + newtab override = full search monetization surface even without host_permissions.
• csp_absent_mv3 manifest content_security_policy is null; MV3 default applies, no additional network penalty but noted.

Permissions Breakdown

• search medium Allows modifying search provider; paired with newtab override creates full search monetization surface.
• chrome_url_overrides.newtab high Replaces every new tab; primary vector for ad/search monetization in shell extensions.

Pillar Scores

Bookkeeping