Top Risks

• Uninstall URL hijack redirects users to tabplugins.com; install URL hijack opens marketing page on extension install.
• Broad *://*/* host_permissions + scripting allows JS injection on every site the user visits.
• Privacy policy admits data collection and third-party sharing but lacks retention disclosure.
• Low install count (311) with HIGH-tier permissions raises tail-attack-surface concern.
• dom_sink_innerhtml_userctrl in main JS and no CSP creates DOM-XSS exposure on all pages.

Evidence

• uninstall_url_hijack crx setUninstallURL points to tabplugins.com/cursors/ via Google redirect wrapper.
• install_url_hijack crx onInstalled opens tabplugins.com/brawl-stars-cursor/ with UTM tracking params.
• broad_host_permissions manifest host_permissions and content_scripts_matches both set to *://*/* with scripting permission.
• no_csp manifest content_security_policy is null; csp_present==false on MV3 extension.
• dom_sink_innerhtml_userctrl crx innerHTML assigned from variable in static/js/main.4964ab1e.js — DOM-XSS sink without CSP.
• privacy_policy_third_party_sharing api Policy fetched; scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• small_install_high_perm store 311 installs with HIGH-tier permission (*://*/*) — tail attack surface flagged.
• install_and_uninstall_url_hijack store Both install and uninstall URL hijacks present — Webstore +2.0 each per rubric.

Permissions Breakdown

• storage low Stores cursor preferences locally; standard low-risk.
• unlimitedStorage low Allows larger local storage; low risk for cursor assets.
• scripting medium Enables JS injection into pages; paired with *://*/* becomes high-reach.
• *://*/* high Broad host access across all sites; enables content injection everywhere.

Pillar Scores

Bookkeeping