Top Risks

• Uninstall URL hijack to owhit.com and install URL hijack confirm monetization shell pattern.
• New-tab override paired with search permission; wallpaper shell is a known ad-monetization vector.
• Privacy policy is Google's own generic policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• Free-webmail dev email (gmail) with no business website; developer identity unverifiable.
• 9 external JS hosts including owhit.com, yowgames.com, Instagram, Netflix, YouTube — far beyond wallpaper function.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → https://owhit.com/uninstall; classic monetization shell telltale.
• install_url_hijack manifest onInstalled opens https://owhit.com/killua-graffiti-cool-live-wallpaper; 3rd-party redirect on install.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab with extension page.
• privacy_policy_generic store Policy URL is Google's account privacy page — scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_dev store Developer email gokcey638@gmail.com; no verifiable business domain; Vivid Visuals unverified.
• js_external_hosts crx 9 external hosts: owhit.com, yowgames.com, chat.openai.com, instagram, netflix, youtube, x.com, google, chrome.
• no_csp manifest content_security_policy is null; MV3 provides default but no explicit hardening declared.
• webstore_monetization_shell store Wallpaper/NewTab category + install/uninstall URL hijack to owhit.com = textbook traffic-monetization shell.

Permissions Breakdown

• search medium Allows overriding search provider; medium risk on its own but paired with newtab override.
• chrome_url_overrides.newtab high Replaces new-tab page entirely; classic monetization/tracking surface for wallpaper shells.

Pillar Scores

Bookkeeping