Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Mercedes F1 Car Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override (index.html) gives persistent control of every new tab; uninstall URL hijack to owhit.com confirms monetization intent.
• Privacy policy is Google's own generic policy (scope_extension=false, data_collection=true, third_party_sharing=true) — worst-case v3.5D: +10 privacy pillar.
• Install URL hijack to owhit.com on install opens 3rd-party page; combined with uninstall hijack signals traffic-monetization shell.
• Free-webmail Gmail dev with no developer name and no business domain; verified_publisher badge does not remove accountability gap.

Evidence

• newtab_override manifest chrome_url_overrides.newtab='index.html' — replaces all new tabs; +2.0 Webstore new-tab override with monetization shape.
• uninstall_url_hijack crx setUninstallURL -> https://owhit.com/uninstall; +3.0 Webstore per rubric rule.
• install_url_hijack crx onInstalled opens https://owhit.com/mercedes-f1-car-wallpaper; +2.0 Webstore per rubric rule.
• privacy_policy_generic store Policy is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy (v3.5D).
• free_webmail_no_devname store developer_email=nermincandas@gmail.com, developer_name empty; +1.5 Reputation free-webmail, +1.0 no dev name.
• js_external_hosts_scope_mismatch crx 8 external hosts (Netflix, Instagram, YouTube, X, ChatGPT etc.) for a wallpaper newtab extension — unexplained breadth.
• verified_publisher store verified_publisher=true grants -3.0 Reputation; but monetization hits cap VP discount to -1.0 per v3.5E.
• cve_findings_empty crx No CVE findings; jquery 3.7.1 is current and unvulnerable. CVE pillar = 0.0.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Mercedes F1 Car Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.79 -> 8.29 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Can override search provider behavior; medium-risk in context of newtab override.
• chrome_url_overrides.newtab high Replaces every new tab page; high reach monetization surface, scored per v2 rule (a).

Pillar Scores

Bookkeeping