Top Risks

• Uninstall URL hijack to owhit.com — classic monetization shell pattern signalling tracking/ad intent.
• Install URL hijack to owhit.com — opens 3rd-party page on install, strong monetization signal.
• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and third-party sharing.
• NewTab override combined with 'search' permission and 8 external JS hosts (ChatGPT, Netflix, YouTube, Instagram, X, etc.) far exceeds wallpaper function.
• Free-webmail developer with no business presence; no verified publisher; theme/wallpaper shell pattern over monetization infrastructure.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL -> https://owhit.com/uninstall; 3rd-party tracking/monetization on uninstall.
• install_url_hijack crx onInstalled opens https://owhit.com/star-wars-darth-vader-live-wallpaper; 3rd-party page injection on install.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab for 925 users.
• generic_privacy_policy store Policy is Google account policy (479KB); scope_extension=false, data_collection=true, third_party_sharing=true.
• js_external_hosts crx 8 external hosts: chat.openai.com, instagram.com, netflix.com, youtube.com, x.com, owhit.com — far exceeds wallpaper scope.
• free_webmail_developer store Developer nermincandas@gmail.com; no business domain; not verified publisher; not featured.
• fan_content_shell_pattern store Star Wars fan theme shell with monetization infrastructure (owhit.com hijacks + multi-platform JS hosts).
• privacy_policy_d_clause api fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true -> Privacy pillar D clause: +10.0.

Permissions Breakdown

• search medium Allows overriding search provider; paired with newtab override creates monetization surface.
• chrome_url_overrides.newtab high Replaces every new tab — high reach, monetization/redirect risk on all browsing sessions.

Pillar Scores

Bookkeeping