Top Risks

• Uninstall URL hijack to owhit.com — classic monetization-shell fingerprint
• Install URL hijack to owhit.com — tracks new installs and can redirect users on setup
• NewTab override + search permission replaces every new tab with developer-controlled page
• Privacy policy is Google's own generic policy — does not scope to this extension at all (admitted data & 3rd-party sharing)
• Free-webmail dev (bisarozbey4@gmail.com), no verified publisher, no business domain — low accountability

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() → https://owhit.com/uninstall; 3rd-party tracking on removal.
• install_url_hijack crx onInstalled opens https://owhit.com/anonymous-live-wallpaper/; 3rd-party URL on every install.
• newtab_override manifest chrome_url_overrides.newtab = index.html; controls every new tab page opened by the user.
• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_dev store Developer email bisarozbey4@gmail.com; no verified publisher badge; no business domain.
• js_external_hosts crx JS references 8 external origins incl. owhit.com, instagram.com, netflix.com, x.com — broad unsanctioned reach.
• no_csp manifest content_security_policy is null; no CSP on MV3 extension with external JS host references.
• new_tab_monetization_shape store NewTab + uninstall/install hijack to owhit.com matches monetization-shell pattern; only 61 installs.

Permissions Breakdown

• search medium Can manipulate search provider; medium risk on its own but paired with newtab override elevates concern.
• chrome_url_overrides.newtab high Replaces every new tab page; prime real estate for ad-monetization and data collection.

Pillar Scores

Bookkeeping