Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Avengers Cursor ★ Custom Cursor for Chrome™ [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall URL hijack to yowgames.com (utm-tracked) — classic monetization/traffic shell pattern.
• Install URL hijack to yowgames.com — onInstalled redirects user to 3rd-party site.
• Privacy policy is generic (yowgames.com), not scoped to this extension; admits data collection and third-party sharing.
• Developer uses free Gmail with no verified identity; domain identity cannot be confirmed.

Evidence

• uninstall_url_hijack manifest setUninstallURL → https://yowgames.com/avengers-cursor with UTM params; monetization redirect on remove.
• install_url_hijack manifest onInstalled opens https://yowgames.com/avengers-cursor with UTM params; 3rd-party traffic grab.
• content_scripts_broad manifest content_scripts_matches: [*://*/*] — runs on every site the user visits.
• privacy_policy_generic store Policy at yowgames.com: fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email afraezgi4@gmail.com; no verified publisher; identity unverifiable.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening declared.
• js_external_host_yowgames crx js_external_hosts includes yowgames.com alongside chrome.google.com.
• cve_findings_empty crx No CVEs found; jquery 3.6.0 bundled (no known CVEs at this version in findings).
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Avengers Cursor ★ Custom Cursor for Chrome™ [adware] + malext.io malicious_extension_sentry; score 5.09 -> 7.59 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Stores cursor preference settings locally; low standalone risk.
• content_scripts *://*/* medium Injects JS/CSS on every page visited; broad surface for cursor injection but also data access.

Pillar Scores

Bookkeeping