Top Risks

• Uninstall URL hijack to owhit.com — classic monetization/tracking shell pattern.
• Install URL hijack to owhit.com on onInstalled — opens 3rd-party page without user consent.
• Privacy policy is a generic Google account page that failed to fetch and has no extension scope.
• NewTab override with 'search' permission and contacts 8 external hosts including social/streaming platforms.
• Free-webmail dev (gmail) with no verified publisher, no business domain, and no rating data.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → https://owhit.com/uninstall — hard monetization/tracking signal.
• install_url_hijack crx onInstalled opens https://owhit.com/bart-graffiti-artist-live-wallpaper — unsolicited 3rd-party page.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab with extension-controlled page.
• external_hosts crx 8 JS external hosts incl. owhit.com, instagram.com, netflix.com, x.com — far beyond wallpaper function.
• privacy_policy_unfetchable store Policy URL is generic Google account page; fetch failed SSLError; no extension-specific scope.
• free_webmail_dev store Developer email aslizeytinli52@gmail.com — free webmail, no business domain, no verified publisher.
• new_tab_monetization_shell manifest Wallpaper/entertainment wrapper overriding newtab + search permission = textbook monetization shell.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit policy declared.

Permissions Breakdown

• search medium Allows reading search queries; combined with newtab override raises monetization risk.
• chrome_url_overrides.newtab high Replaces every new tab page; primary vector for ad/search monetization in wallpaper shells.

Pillar Scores

Bookkeeping