Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — The Legend of Zelda Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall URL hijack sends users to owhit.com on removal — monetization/tracking signal.
• Install URL hijack opens owhit.com on install — onboarding funnel to third-party site.
• Privacy policy URL returns HTTP error; policy effectively absent (scored +10 privacy).
• NewTab override + search permission replaces high-reach browser surface with unverified content.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → https://owhit.com/uninstall; 3rd-party redirect on removal.
• install_url_hijack manifest onInstalled opens https://owhit.com/the-legend-of-zelda-live-wallpaper on first run.
• privacy_policy_fetch_failed api privacy_policy_classification.fetched==false; HTTPError on https://owhit.com/privacy-policy/.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new-tab for all users.
• free_webmail_no_dev_name store Developer email tekbatuhan64@gmail.com; developer_name is empty string.
• js_external_hosts_broad crx 8 external hosts referenced: chat.openai.com, instagram.com, netflix.com, youtube.com, x.com, etc.
• no_csp manifest content_security_policy is null; csp_present==false on MV3 extension.
• verified_publisher_flag store verified_publisher==true but domain owhit.com unresolvable; discount capped per invariant 0c.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — The Legend of Zelda Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 4.96 -> 7.46 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/modifying search queries; elevated in a NewTab override context.
• chrome_url_overrides.newtab medium Replaces new-tab page; high-reach surface for monetization or data collection.

Pillar Scores

Bookkeeping