Top Risks

• Uninstall URL hijack to owhit.com and install URL hijack — classic monetization-shell pattern.
• NewTab override combined with 'search' permission enables full search redirect / ad monetization.
• Privacy policy is Google's own policy (not scoped to extension), admits data collection and 3rd-party sharing — Privacy pillar 10.
• Free-webmail dev (gmail), no verified publisher, no business website — high reputation risk.
• Low rating (2.3) and suspicious JS external hosts (Netflix, Instagram, YouTube, OpenAI) on a wallpaper extension.

Evidence

• uninstall_url_hijack crx setUninstallURL → https://owhit.com/uninstall; 3rd-party domain hijack scores +3.0 Webstore.
• install_url_hijack crx onInstalled opens https://owhit.com/katseye-live-wallpaper; 3rd-party install hijack +2.0 Webstore.
• newtab_override manifest chrome_url_overrides.newtab = index.html; monetization surface +2.0 Webstore.
• privacy_policy_generic store Policy is Google account privacy policy; scope_extension=false, data_collection=true, 3rd_party_sharing=true → +10.0 Privacy.
• free_webmail_dev store Developer email sonerrgulay93@gmail.com; no verified publisher, no business site → Reputation floor applied.
• low_rating store Rating 2.3; concerning quality signal.
• js_external_hosts_mismatch crx Wallpaper extension contacts Netflix, Instagram, YouTube, OpenAI, x.com — scope mismatch for stated function.
• no_csp manifest csp_present=false on MV3; v2 calibration +2.0 Network penalty applied.

Permissions Breakdown

• search medium Allows manipulation of the default search provider; combined with NewTab override enables search hijacking.
• chrome_url_overrides.newtab high Replaces every new tab page; monetization surface for ad injection and search hijacking.

Pillar Scores

Bookkeeping