Top Risks

• NewTab override + search permission: classic search-monetization shell pattern with uninstall/install URL hijack.
• Uninstall and install URL hijacking detected — extension redirects on install/uninstall events.
• JS contacts chatgpt.com, instagram.com, youtube.com, x.com — unrelated to stated wallpaper function.
• Privacy policy admits data collection and third-party sharing but lacks retention disclosure.
• No developer name listed; spider-man fan-content shell raises ToS-violation concerns.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html; replaces every new tab with extension page.
• uninstall_install_hijack crx uninstall_url_hijack=true AND install_url_hijack=true; extension fires redirect events on lifecycle.
• external_js_hosts crx JS contacts chatgpt.com, instagram.com, x.com, youtube.com — unrelated to wallpaper/newtab purpose.
• privacy_policy_third_party_sharing api Policy fetched; scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• no_developer_name store developer_name is empty string; reduces accountability signal.
• fan_content_shell store Spider-Man branded wallpaper likely unlicensed IP; fan-content/theme shell pattern applies.
• verified_publisher store verified_publisher=true; provides partial trust discount but doesn't explain unrelated JS hosts.
• csp_absent_mv3 manifest csp_present=false on MV3; MV3 has strict defaults so no additional network penalty applied.

Permissions Breakdown

• search medium Allows querying the browser search API; paired with newtab override enables search monetization.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary vector for search monetization and traffic hijacking.

Pillar Scores

Bookkeeping