Top Risks

• New-tab override hijacks every new browser tab via owhit.com shell; classic monetization/adtech vector.
• Uninstall and install URL hijacks both point to owhit.com, a third-party domain not owned by developer.
• Privacy policy is Google's generic account policy — does not scope to this extension at all (data_collection+third_party_sharing admitted, scope_extension=false) → +10 privacy.
• Free-webmail Gmail developer with no business domain; no verified publisher or featured badge.
• Extension contacts 8 external hosts (YouTube, Netflix, Instagram, X, OpenAI, etc.) with no CSP declared.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → https://owhit.com/uninstall (3rd-party domain, +3.0 Webstore)
• install_url_hijack crx onInstalled opens https://owhit.com/among-us-live-wallpaper/ (+2.0 Webstore)
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab (+2.0 Webstore)
• privacy_policy_generic store Policy is Google account policy: scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy (v3.5-D)
• free_webmail_dev store Developer email nermincandas@gmail.com; no business site; no verified publisher → Reputation floor 7.5
• js_external_hosts crx 8 external hosts including openai.com, netflix.com, instagram.com, x.com — no CSP declared (MV3 strict default applies)
• no_csp manifest csp_present=false; MV3 so no +2.0 MV2 penalty; but >3 distinct external hosts flagged
• cve_findings_raw_empty crx jquery 3.7.1 bundled; cve_findings_raw=[]; no CVE score applied.

Permissions Breakdown

• search medium Allows read/manipulation of search settings; medium risk on its own.
• chrome_url_overrides.newtab medium Replaces new-tab page; prime monetization surface, hijacks user start page.

Pillar Scores

Bookkeeping