Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Nissan GTR Nismo R35 Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall URL hijack to owhit.com — classic monetization/tracking shell pattern.
• Install URL hijack to owhit.com — opens 3rd-party page on install for traffic monetization.
• Privacy policy is Google's generic account policy (fetch failed); not scoped to this extension — effectively no policy.
• NewTab override + search permission together enable full search-redirect monetization without user awareness.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL points to https://owhit.com/uninstall — 3rd-party monetization/tracking domain.
• install_url_hijack manifest onInstalled opens https://owhit.com/nissan-gtr-nismo-r35-live-wallpaper — 3rd-party URL redirect on install.
• newtab_override manifest chrome_url_overrides.newtab set to index.html; combined with search permission enables search monetization.
• privacy_policy_not_scoped store Policy URL is Google account privacy page; fetch failed (SSLError); not scoped to this extension at all.
• free_webmail_developer store Developer email tekbatuhan64@gmail.com with no verified publisher badge and no business domain.
• js_external_hosts_breadth crx 8 external hosts referenced: owhit.com, chat.openai.com, netflix.com, instagram.com, youtube.com, x.com, etc.
• csp_absent_mv3 manifest No content_security_policy declared; MV3 defaults apply but no explicit restriction on connect-src.
• no_operator_siblings api operator_cluster sibling_count=0; single extension under this fingerprint so far.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Nissan GTR Nismo R35 Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.34 -> 7.84 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows overriding the browser search provider; can redirect user searches to monetization endpoints.
• chrome_url_overrides.newtab medium Replaces every new tab with extension-controlled page; primary vector for ad/affiliate monetization.

Pillar Scores

Bookkeeping