Top Risks

• NewTab override + uninstall/install URL hijack to owhit.com: classic ad-monetization shell pattern.
• Privacy policy is Google's generic policy — does not scope to this extension at all (+10.0 privacy pillar).
• Free-webmail developer (gmail) with no verified business; no verified publisher badge.
• Contacts 7 external JS hosts (chatgpt.com, instagram.com, x.com, youtube.com, owhit.com, etc.) with no CSP.
• search permission + NewTab override enables full search-monetization pipeline without broad host permissions.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → https://owhit.com/uninstall (3rd-party redirect on uninstall).
• install_url_hijack manifest onInstalled opens https://owhit.com/shinobu-kocho-wallpaper (3rd-party page on install).
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab served by extension.
• generic_privacy_policy store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension.
• free_webmail_developer store Developer email bulenttuncer250@gmail.com; no verified publisher; no business domain.
• external_js_hosts crx 7 external hosts referenced: owhit.com, chatgpt.com, instagram.com, x.com, youtube.com, google.com, chrome.google.com.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP tightening.
• search_permission_newtab manifest search permission combined with NewTab override enables search-monetization without host permissions.

Permissions Breakdown

• search medium Allows reading search queries; combined with NewTab override amplifies search monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; primary vector for ad/search monetization.

Pillar Scores

Bookkeeping