Top Risks

• Uninstall URL hijack to owhit.com — classic monetization shell pattern with tracking on removal.
• Install URL hijack to owhit.com — opens 3rd-party page on install, confirmed monetization funnel.
• New-tab override paired with 'search' permission: every new tab is a revenue surface.
• Privacy policy is Google's own generic policy — not scoped to this extension at all, admits data/3rd-party sharing.
• Free-webmail dev (gmail) with no verified business domain; no publisher verification.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → https://owhit.com/uninstall; 3rd-party tracking on removal.
• install_url_hijack manifest onInstalled opens https://owhit.com/ocean-glow-with-goku-live-wallpaper; monetization funnel.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab hijacked.
• privacy_policy_generic store Policy URL is Google's own account privacy page; scope_extension=false, admits data collection + 3rd-party sharing.
• free_webmail_developer store Developer email acelyasereflerim@gmail.com; no verified business; no publisher badge.
• external_js_hosts crx 8 external hosts incl. owhit.com, chat.openai.com, instagram, netflix, youtube, x.com — broad surface.
• new_tab_monetization_shape manifest NewTab + search permission + install/uninstall hijacks = textbook ad-monetization cluster.
• no_csp manifest content_security_policy is null; MV3 strict default applies but no explicit policy declared.

Permissions Breakdown

• search medium Allows reading/modifying search queries; combined with newtab override amplifies monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab; primary vector for ad-monetization and search hijacking.

Pillar Scores

Bookkeeping