Top Risks

• Uninstall URL hijack routes to yowgames.com UTM-tracked page — monetization shell behaviour.
• Install URL hijack opens yowgames.com on install — classic traffic-monetization pattern.
• Privacy policy not scoped to this extension but admits data collection and third-party sharing (+10 privacy).
• Free-webmail dev email (gmail) with no verified publisher — low accountability.
• Content scripts run on *://*/* giving full page access on every site despite tiny install base.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL points to yowgames.com with UTM tracking — monetization redirect.
• install_url_hijack manifest onInstalled opens yowgames.com with UTM params — install traffic hijack confirmed.
• privacy_policy_unscoped_admits_sharing api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• free_webmail_developer store Developer email busrakaraman256@gmail.com; no verified publisher; dev domain is gmail.com.
• content_scripts_all_urls manifest content_scripts_matches=[*://*/*] injects into every page; high reach for a cursor extension.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• jquery_3.6.0_bundled crx jquery 3.6.0 bundled; no CVEs found in cve_findings_raw at this version.
• low_installs_hijack_pattern store Only 290 installs but both install and uninstall URL hijacks active — monetization-shell fingerprint.

Permissions Breakdown

• storage low Used to persist cursor preference; low risk in isolation.
• content_scripts *://*/* high Injects JS/CSS into every page visited; broad reach despite minimal declared permissions.

Pillar Scores

Bookkeeping