Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Star Wars Cursor ★ Custom Cursor for Chrome™ [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall URL hijack to yowgames.com with UTM tracking — classic monetization shell fingerprint.
• Install URL hijack to yowgames.com — redirects user on install for ad/affiliate credit.
• Privacy policy fetched but NOT scoped to this extension; admits data collection and third-party sharing (+10 privacy).
• Free-webmail developer (gmail) with no verified publisher; policy domain yowgames.com is unrelated to stated developer identity.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → yowgames.com with UTM params; classic traffic-monetization pattern.
• install_url_hijack manifest onInstalled opens yowgames.com UTM URL; affiliate/ad credit on every install.
• privacy_policy_not_scoped api Policy at yowgames.com: scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email ayseozkacar237@gmail.com; not a verified publisher; no business domain.
• content_scripts_broad manifest content_scripts_matches=[*://*/*] — injects into every HTTP/HTTPS page.
• external_host_yowgames crx js_external_hosts includes yowgames.com; extension contacts third-party game-portal domain.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• maintenance_3_6mo store months_since_update=9; falls in 6-12 month stale band (+3.5).
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Star Wars Cursor ★ Custom Cursor for Chrome™ [adware] + malext.io malicious_extension_sentry; score 4.57 -> 7.07 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Stores cursor preferences locally; low abuse potential on its own.
• content_scripts *://*/* medium Runs on every page; broad reach even without explicit host_permissions grant.

Pillar Scores

Bookkeeping