Top Risks

• Uninstall URL hijack to owhit.com — classic monetization/tracking shell pattern (+3.0 webstore)
• Install URL hijack to owhit.com opens 3rd-party page on every install (+2.0 webstore)
• NewTab override with search permission — search hijacking and ad-monetization vector
• Privacy policy is generic Google account policy, not scoped to this extension — admits data collection and 3rd-party sharing (+10.0 privacy)
• Free-webmail dev (gmail), no developer name, no verified publisher — no accountability

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL targets https://owhit.com/uninstall — 3rd-party monetization/tracking.
• install_url_hijack crx onInstalled opens https://owhit.com/audi-r8-wallpaper — 3rd-party page injection on install.
• newtab_override manifest chrome_url_overrides.newtab = index.html; paired with search permission enables search monetization.
• privacy_policy_generic store Policy URL is Google's own account privacy page — scope_extension=false, data_collection=true, third_party_sharing=true.
• developer_identity store Dev email kutaybelgen@gmail.com (free webmail), no developer name, no verified publisher badge.
• js_external_hosts crx Extension JS references 8 external hosts incl. chatgpt.com, netflix.com, instagram.com, x.com, owhit.com.
• new_tab_monetization_shell store Wallpaper/NewTab shell pattern with uninstall+install hijack to owhit.com — textbook traffic-monetization cluster.
• no_csp manifest content_security_policy is null (MV3 default applies, but no explicit CSP declared; csp_present=false).

Permissions Breakdown

• search medium Allows querying browser search engine; paired with newtab override, enables search hijacking.
• chrome_url_overrides.newtab high Replaces every new tab; core monetization vector for wallpaper/NewTab shells.

Pillar Scores

Bookkeeping