Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Minecraft Sakura Land Live Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override hijacks every new tab for a Gmail-account dev with no verified identity, enabling persistent monetization.
• Minecraft brand impersonation by unconfirmed developer (demorelmert101@gmail.com, not a Mojang/Microsoft entity).
• Uninstall URL hijack to owhit.com — classic traffic-monetization shell pattern.
• Install URL hijack to owhit.com on every install — third-party redirect on install event.

Evidence

• newtab_override manifest chrome_url_overrides.newtab=index.html replaces every new tab; combined with 'search' permission is monetization-shell pattern.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL -> https://owhit.com/uninstall; textbook traffic-monetization redirect.
• install_url_hijack crx onInstalled opens https://owhit.com/minecraft-sakura-land-live-wallpaper on every install.
• brand_impersonation store brand_mention.is_impersonation=true for 'minecraft'; developer is gmail account, confirmed_owner=false.
• generic_privacy_policy store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — applies +10.0 privacy.
• free_webmail_dev store Developer email demorelmert101@gmail.com; no business website; no verified publisher badge.
• js_external_hosts crx 9 external hosts including owhit.com, yowgames.com, chat.openai.com, netflix.com, instagram.com — broad unrelated scope.
• new_tab_monetization_override manifest NewTab+search+uninstall hijack+install hijack = classic monetization-shell cluster per rubric.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Minecraft Sakura Land Live Wallpaper [adware] + malext.io malicious_extension_sentry; score 6.18 -> 8.68 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Enables search provider interaction; combined with newtab override creates monetization surface.
• chrome_url_overrides.newtab high Replaces every new tab — high-reach hijack vector with monetization/tracking potential.

Pillar Scores

Bookkeeping