Top Risks

• Uninstall URL hijack to owhit.com and install URL hijack — confirmed monetization shell pattern (+3.0+2.0 Webstore).
• Privacy policy is Google's generic account policy: fetched, not scoped to this extension, admits data collection and 3rd-party sharing → Privacy pillar 10.0.
• NewTab override + search permission silently routes all new-tab searches; owhit.com is an undisclosed 3rd-party operator.
• Free-webmail Gmail dev with no business website; no verified publisher badge — Reputation elevated.
• js_external_hosts includes chat.openai.com, instagram.com, netflix.com, youtube.com, x.com — broad undisclosed external reach from a wallpaper extension.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → https://owhit.com/uninstall; 3rd-party operator not disclosed in listing.
• install_url_hijack crx onInstalled opens https://owhit.com/ghost-of-tsushima-live-wallpaper; unsolicited 3rd-party redirect.
• newtab_override manifest chrome_url_overrides.newtab = index.html; every new-tab captured by wallpaper/monetization page.
• privacy_policy_generic store Policy URL is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true) → +10.0 privacy.
• free_webmail_dev store Developer email tekbatuhan64@gmail.com; no verified publisher; no business domain.
• js_external_hosts_broad crx 8 external hosts incl. instagram.com, netflix.com, youtube.com, x.com, chat.openai.com — unexpected for a wallpaper.
• search_permission_newtab manifest search permission + newtab override = full search-route capability through owhit.com operator.
• cve_findings_empty crx jquery 3.7.1 bundled; cve_findings_raw empty; no CVE risk scored.

Permissions Breakdown

• search medium Allows overriding search provider; paired with newtab override this routes all searches.
• chrome_url_overrides.newtab high Replaces every new tab page; prime monetization and data-collection surface.

Pillar Scores

Bookkeeping