Top Risks

• Uninstall URL hijack to owhit.com — classic monetization shell pattern tracking uninstalls.
• Install URL hijack to owhit.com — opens 3rd-party page on install for affiliate/ad attribution.
• New-tab override replaces every new tab; privacy policy is generic Google policy with no extension scope.
• Free-webmail developer (gmail) with no business website; privacy policy admits 3rd-party data sharing but is not scoped to this extension.
• Extension contacts 8 unrelated external JS hosts (Netflix, Instagram, YouTube, X, OpenAI) far beyond stated wallpaper function.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → https://owhit.com/uninstall; monetization shell indicator.
• install_url_hijack manifest onInstalled opens https://owhit.com/windows-xp-live-wallpaper; affiliate/ad tracking on install.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new tab hijacked by extension.
• generic_privacy_policy store Privacy policy is Google's own account policy (scope_extension=false, data_collection=true, third_party_sharing=true).
• free_webmail_developer store Developer email acelyasereflerim@gmail.com; no verified business domain.
• external_js_hosts crx 8 external hosts including Netflix, Instagram, YouTube, X, OpenAI — unrelated to wallpaper function.
• search_permission_with_newtab manifest search permission combined with newtab override enables search provider manipulation.
• no_csp crx csp_present=false on MV3; no content_security_policy declared in manifest.

Permissions Breakdown

• search medium Allows reading/manipulating search provider; medium risk on its own but combined with newtab override is elevated.
• chrome_url_overrides.newtab high Replaces new-tab page entirely — prime vector for search hijack and ad monetization.

Pillar Scores

Bookkeeping