Top Risks

• Uninstall URL hijack to yowgames.com with UTM tracking — monetization shell pattern.
• Install URL hijack to yowgames.com — fires on every install, third-party redirect.
• Content script on *://*/*EveryPage access despite cursor-only stated function.
• Free-webmail dev (gmail) with no verified publisher; privacy policy not scoped to this extension.
• Privacy policy admits data collection and third-party sharing without extension-specific scope.

Evidence

• uninstall_url_hijack manifest setUninstallURL → yowgames.com with utm_source=Uninstall; classic monetization shell pattern (+3.0 Webstore).
• install_url_hijack manifest onInstalled opens yowgames.com with UTM params (+2.0 Webstore).
• content_scripts_broad manifest content_scripts matches *://*/* — runs on every site for a cursor extension.
• free_webmail_dev store developer_email=afraezgi4@gmail.com; numbered-alias pattern; no verified publisher (+3.0 Webstore numbered alias).
• privacy_policy_not_scoped api Policy fetched from yowgames.com: scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy (D rule).
• js_external_hosts crx Extension contacts chrome.google.com and yowgames.com; 2 distinct registrable domains.
• reputation_free_webmail store Free-webmail dev, no verified publisher, no featured badge; reputation floor applied at 7.5.
• cve_findings_empty crx No CVEs found; jquery 3.6.0 bundled but cve_findings_raw is empty — CVE pillar 0.0.

Permissions Breakdown

• storage low Stores cursor preference settings locally; low risk in isolation.
• content_scripts *://*/* high Content script runs on every page, enabling broad DOM access and data reach.

Pillar Scores

Bookkeeping