Top Risks

• Uninstall URL hijack to owhit.com — classic monetization/tracking shell pattern.
• Install URL hijack to owhit.com — opens 3rd-party page on install, fingerprinting risk.
• NewTab override + search permission: every new tab is an ad-monetization surface.
• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Free-webmail dev (gmail) with no verified business identity; numbered alias email pattern.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → https://owhit.com/uninstall; hard +3.0 Webstore.
• install_url_hijack manifest onInstalled opens https://owhit.com/honkai-star-rail-live-wallpaper; hard +2.0 Webstore.
• newtab_override manifest chrome_url_overrides.newtab = index.html; search monetization vector +2.0 Permissions.
• privacy_policy_generic store Policy is Google account policy: scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy.
• free_webmail_dev store Developer email acelyaserefler0638@gmail.com with numbered alias; no verified business domain.
• js_external_hosts crx 8 external hosts including owhit.com, chat.openai.com, instagram.com, netflix.com, x.com.
• no_csp manifest csp_present=false on MV3; no additional network penalty per v2 rules but noted.
• operator_cluster api sibling_count=0; fingerprint anchored to owhit.com and gmail address.

Permissions Breakdown

• search medium Allows search provider interaction; combined with newtab override creates search monetization surface.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; primary vector for ad/search monetization.

Pillar Scores

Bookkeeping