Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Cat Cursor ♥ Custom Cursor for Chrome™ [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall URL hijack redirects to yowgames.com with UTM tracking — monetization shell pattern.
• Install URL hijack opens yowgames.com on install — classic monetization/traffic harvesting signal.
• Privacy policy (yowgames.com) admits data collection and third-party sharing but is NOT scoped to this extension — D rule +10.0.
• Free-webmail developer (busrakaraman256@gmail.com) with no verified identity; dev_name 'wallpaperlive' doesn't match privacy domain.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → yowgames.com with UTM params; +3.0 Webstore.
• install_url_hijack manifest onInstalled opens yowgames.com with UTM params; +2.0 Webstore.
• privacy_policy_D_rule api Policy fetched, scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy.
• free_webmail_developer store busrakaraman256@gmail.com; no verified publisher, no featured badge → Reputation elevated.
• content_scripts_all_urls manifest *://*/*ontent scripts inject into every site; broad reach with no CSP.
• js_external_hosts crx yowgames.com listed as external JS host; same domain as install/uninstall hijack target.
• no_csp manifest content_security_policy null; MV3 strict default applies but no explicit CSP declared.
• low_rating store Rating 3.0 on a small install base (2,000); below-average user satisfaction.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Cat Cursor ♥ Custom Cursor for Chrome™ [adware] + malext.io malicious_extension_sentry; score 3.49 -> 5.99 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Stores cursor preferences locally; low risk.
• content_scripts *://*/* high Injects JS into every page; broad reach even without explicit host_permissions.

Pillar Scores

Bookkeeping