Top Risks

• Uninstall URL hijack redirects to play.owhit.com (ad/monetization domain); install URL hijack to chromewallpaper.com.
• Privacy policy is Google's generic account policy — scope_extension=false, data_collection=true, third_party_sharing=true; admits sharing without extension scope.
• Free-webmail developer (burakakkan420@gmail.com) with no verified business; numbered-alias email pattern.
• NewTab override with search permission and 10 external JS hosts including mlionltd.github.io (GitHub-hosted CDN) and play.owhit.com.
• 17 months since last update on a NewTab shell with no CSP and monetization URL hooks.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL targets play.owhit.com — a 3rd-party ad/game portal with UTM tracking params.
• install_url_hijack crx onInstalled opens chromewallpaper.com with UTM params — install-time traffic monetization.
• privacy_policy_generic store PP is Google account policy: scope_extension=false, data_collection=true, third_party_sharing=true. Scores +10 (D rule).
• free_webmail_developer store Developer email burakakkan420@gmail.com — numbered alias Gmail, no business domain, no verified publisher.
• newtab_override_with_search manifest chrome_url_overrides.newtab + search permission = search monetization shell pattern.
• external_js_hosts crx 10 external hosts including mlionltd.github.io (CDN), play.owhit.com, chatgpt.com, instagram.com, netflix.com.
• no_csp manifest content_security_policy is null on MV3; +2.0 network penalty for MV2-era absent CSP not applicable but noted.
• stale_update store 17 months since last update; maintenance score +6.0 (12-24 month band).

Permissions Breakdown

• search medium Allows overriding search provider; combined with newtab override indicates monetization intent.
• chrome_url_overrides.newtab medium Replaces every new tab with extension page; core mechanism for wallpaper/monetization shells.

Pillar Scores

Bookkeeping