Top Risks

• Uninstall & install URL hijack to owhit.com — confirmed monetization shell lifecycle tracking.
• Privacy policy is Google's generic account policy (not extension-scoped), admits data collection + 3rd-party sharing.
• NewTab override + search permission enables full search monetization on every new tab.
• Free-webmail developer with no business identity, no verified publisher.
• 8 external JS hosts (instagram, netflix, youtube, chatgpt, x.com) far exceed wallpaper function.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → https://owhit.com/uninstall; lifecycle tracking to 3rd-party domain.
• install_url_hijack manifest onInstalled opens https://owhit.com/doraemon-fly-wallpaper; monetization shell pattern confirmed.
• newtab_override manifest chrome_url_overrides.newtab=index.html replaces every new tab page.
• privacy_policy_generic store Policy is Google account-level policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email muratpolat0891@gmail.com; no verified publisher, no business domain.
• broad_external_hosts crx 8 external JS hosts: chatgpt.com, instagram.com, netflix.com, youtube.com, x.com, owhit.com, etc.
• search_permission_newtab_combo manifest search permission + newtab override = full search monetization capability.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension with external host references.

Permissions Breakdown

• search medium Allows overriding search provider; combined with NewTab override amplifies monetization risk.
• chrome_url_overrides.newtab medium Replaces every new tab with extension-controlled page; high reach for ad/search monetization.

Pillar Scores

Bookkeeping