Top Risks

• Uninstall URL hijack to owhit.com and install URL hijack — classic monetization shell fingerprint.
• NewTab override with search permission: captures all new-tab queries and can redirect searches.
• Privacy policy is Google's own policy (unscoped); does not describe what this extension collects at all.
• Free-webmail developer (gmail) with no verified business website; no accountability path.
• Extension contacts owhit.com plus 7 major external hosts (YouTube, Netflix, Instagram, X, OpenAI) with no CSP.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL targets https://owhit.com/uninstall — 3rd-party monetization domain.
• install_url_hijack crx onInstalled opens https://owhit.com/youngboy-nba-live-wallpaper — install-redirect to same 3rd party.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab served by extension.
• privacy_policy_unscoped store Policy URL is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true).
• free_webmail_developer store Developer email uygartandogan157@gmail.com; no verified business domain.
• external_hosts crx JS contacts owhit.com, chat.openai.com, instagram, netflix, youtube, x.com, chrome.google.com, google.com.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit script-src restriction declared.
• generic_google_privacy_policy store Privacy policy is myaccount.google.com/privacypolicy — generic Google policy, not extension-specific.

Permissions Breakdown

• search medium Allows overriding search provider; paired with newtab override it captures user queries.
• chrome_url_overrides.newtab medium Replaces every new tab with extension page; high daily-reach monetization surface.

Pillar Scores

Bookkeeping