Top Risks

• Uninstall URL hijack to owhit.com — classic monetization shell fingerprint (+3.0 Webstore).
• Install URL hijack to owhit.com opens 3rd-party page on every install (+2.0 Webstore).
• New-tab override with search permission enables ad/monetization on every new tab session.
• Privacy policy is Google's generic account policy — not scoped to this extension; data_collection+third_party_sharing true → +10.0 Privacy.
• Free-webmail developer (gmail), no verified publisher, no business website → floor Reputation at 7.5.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → https://owhit.com/uninstall; 3rd-party redirect on uninstall.
• install_url_hijack crx onInstalled opens https://owhit.com/hello-kitty-rainbow-live-wallpaper; 3rd-party install hijack.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab controlled by extension.
• generic_privacy_policy store Policy URL is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true) → +10.0 Privacy.
• free_webmail_developer store Developer email tekbatuhan64@gmail.com; no verified publisher; no business domain → Reputation floor 7.5.
• js_external_hosts crx 8 external hosts including chat.openai.com, www.instagram.com, www.netflix.com, x.com, owhit.com.
• new_tab_plus_search_monetization manifest search permission + newtab override = monetization-ready pattern; search_engine_count=1 (google).
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP declared.

Permissions Breakdown

• search medium Allows overriding search behavior; paired with newtab override enables search monetization.
• chrome_url_overrides.newtab high Replaces every new tab with extension-controlled page; prime vector for ad-monetization and data capture.

Pillar Scores

Bookkeeping