Top Risks

• Uninstall URL hijack to owhit.com — classic monetization shell pattern (+3.0 webstore).
• Install URL hijack to owhit.com — redirects users to third-party on install (+2.0 webstore).
• Privacy policy is Google's generic policy, not scoped to this extension, but admits data collection and third-party sharing (+10.0 privacy).
• NewTab override with 'search' permission and third-party domain owhit.com indicates ad-monetization aggregator.
• Free-webmail dev (gmail) with no verified business, no publisher badge; dev identity unverifiable (+1.5 reputation).

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → https://owhit.com/uninstall (third party)
• install_url_hijack manifest onInstalled opens https://owhit.com/alienware-live-wallpaper (third party)
• newtab_override manifest chrome_url_overrides.newtab = index.html; search permission also declared
• privacy_policy_generic store Policy is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true)
• free_webmail_dev store Developer email aslizeytinli52@gmail.com; no verified publisher; no business domain
• js_external_hosts crx Extension references 8 external hosts including owhit.com, instagram.com, netflix.com, x.com
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP declared
• low_install_count store Only 121 installs; tail-attack-surface fingerprint with third-party URL hijacks

Permissions Breakdown

• search medium Allows overriding search provider; medium-risk permission for a NewTab extension.
• chrome_url_overrides.newtab medium Replaces new-tab page; core mechanism for ad-monetization NewTab shells.

Pillar Scores

Bookkeeping