Top Risks

• Uninstall URL hijack to owhit.com — classic monetization/tracking shell pattern.
• Install URL hijack to owhit.com — on-install redirect to 3rd-party ad/tracking page.
• Privacy policy is Google's own generic policy, not scoped to this extension; policy admits data collection and 3rd-party sharing.
• NewTab override with free-webmail dev (gmail) and no verified publisher — fan-content shell pattern.
• JS contacts 7 external domains (owhit.com, YouTube, Netflix, Instagram, X, OpenAI, Google) — high-reach network surface for a wallpaper.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → https://owhit.com/uninstall; classic monetization shell fingerprint.
• install_url_hijack manifest onInstalled opens https://owhit.com/legend-of-zelda-majoras-mask-live-wallpaper on install.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab captured by extension.
• generic_privacy_policy store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_dev store Developer email zeyneparslan7712@gmail.com; no verified publisher; no business domain.
• js_external_hosts crx Extension JS references owhit.com, YouTube, Netflix, Instagram, X, OpenAI, Google — 8 external hosts for a wallpaper.
• fan_content_shell store Title invokes Nintendo IP (Zelda/Majora's Mask); developer is 'Wallpaper Factory'; no brand ownership.
• csp_absent_mv3 manifest content_security_policy is null; MV3 default applied but no explicit CSP hardening.

Permissions Breakdown

• search medium Allows reading/modifying search provider; medium risk on its own but paired with newtab override elevates concern.
• chrome_url_overrides.newtab high Replaces every new tab with extension page; core monetization/hijack surface for wallpaper shells.

Pillar Scores

Bookkeeping