Top Risks

• Uninstall URL hijacked to owhit.com — monetization shell pattern; strong signal of ad-monetization intent
• Install URL hijacked to owhit.com — 3rd-party redirect on every install
• New-tab override + search permission enables search-hijack and ad insertion on all new tabs
• Privacy policy is Google's account policy, entirely unscoped — admits data collection and 3rd-party sharing
• Free-webmail dev, no developer name, no verified publisher — no accountability for future updates

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → https://owhit.com/uninstall; strong monetization-shell fingerprint.
• install_url_hijack crx onInstalled opens https://owhit.com/dandadan-live-wallpaper — 3rd-party redirect on install.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab controlled by extension.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension.
• developer_identity store Free Gmail dev email, empty developer_name, not verified, not featured — minimal accountability.
• js_external_hosts crx 9 external hosts referenced (owhit.com, yowgames.com, chat.openai.com, instagram.com, netflix.com, x.com…).
• no_csp manifest content_security_policy is null; MV3 has strict default but CSP absence noted.
• new_tab_monetization manifest newtab override + search permission + owhit.com URLs = textbook new-tab monetization shell.

Permissions Breakdown

• search medium Can alter search provider behavior; combined with newtab override amplifies search-hijack risk.
• chrome_url_overrides.newtab high Replaces every new tab with extension-controlled page; monetization surface scored under permissions per v2 rule (a).

Pillar Scores

Bookkeeping