Top Risks

• Uninstall URL hijack to owhit.com tracks user departure — clear monetization/tracking signal.
• Install URL hijack to owhit.com fires on every install, sending user data to third party.
• Privacy policy is Google's own generic policy; admits data collection and third-party sharing with no extension scope.
• NewTab override + search permission from anonymous free-webmail dev with no verified identity.
• No developer name, no verified publisher, free-webmail operator — zero accountability.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL targets https://owhit.com/uninstall — third-party tracking on removal.
• install_url_hijack crx onInstalled opens https://owhit.com/fall-autumn-wallpaper — third-party data capture on install.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab controlled by extension.
• privacy_policy_generic store Policy URL is Google's account privacy policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• developer_identity store Developer email servetyahya06@gmail.com (free webmail), no developer name, no verified publisher.
• js_external_hosts crx Extension references 9 external hosts including owhit.com, chatgpt.com, instagram.com, netflix.com, x.com.
• search_permission manifest Declares 'search' permission alongside newtab override — consistent with search monetization pattern.
• csp_absent manifest content_security_policy is null; MV3 default applies but no explicit CSP declared.

Permissions Breakdown

• search medium Allows modifying default search provider; typical for NewTab shells with monetization intent.
• chrome_url_overrides.newtab high Replaces every new tab with extension-controlled page; high-reach monetization surface.

Pillar Scores

Bookkeeping