Top Risks

• Uninstall URL hijack to owhit.com (+3.0) and install URL hijack to owhit.com (+2.0) — classic monetization shell.
• New-tab override replaces every new tab with developer-controlled page; search permission enables provider override.
• Privacy policy is Google's own account policy — not scoped to this extension; admits data collection and 3rd-party sharing (+10.0).
• Free-webmail developer (dermanseven32@gmail.com) with no verified business identity; no publisher verification.
• 8 external JS hosts including YouTube, Netflix, Instagram, X, OpenAI — far beyond wallpaper scope.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → https://owhit.com/uninstall; 3rd-party redirect on uninstall.
• install_url_hijack manifest onInstalled opens https://owhit.com/batman-live-wallpaper; 3rd-party URL on install.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces all new tabs.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email dermanseven32@gmail.com; no verified publisher; no business website.
• js_external_hosts_broad crx 8 external hosts: owhit.com, YouTube, Netflix, Instagram, X, OpenAI, Google, Chrome — unrelated to wallpaper.
• search_permission_newtab_combo manifest search + newtab override together enable full search provider substitution.
• csp_absent_mv3 manifest content_security_policy null; no explicit CSP despite external host contacts.

Permissions Breakdown

• search medium Allows overriding search provider; medium risk on its own but paired with newtab override.
• chrome_url_overrides.newtab medium Replaces every new tab page; high-reach monetization surface, scored per v2 rule (a).

Pillar Scores

Bookkeeping