Top Risks

• Uninstall + install URL hijack to yowgames.com with UTM tracking — confirmed monetization shell pattern.
• Privacy policy (yowgames.com) explicitly admits data collection and third-party sharing but is not scoped to this extension → worst-case privacy score.
• Brand impersonation: mentions 'Meta' (Meta Knight) while dev is unverified gmail user with no confirmed ownership.
• Content script runs on *://*/* giving DOM access to every site despite a custom-cursor stated function.
• Free-webmail dev email (gmail), no verified publisher, dev domain unresolvable from listing context.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → yowgames.com with UTM params; traffic-monetization pattern.
• install_url_hijack manifest onInstalled opens yowgames.com with UTM params; confirms install-redirect monetization.
• privacy_policy_scope_mismatch api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → D-clause: +10.0.
• brand_impersonation store brand_mention.is_impersonation=true (Meta); confirmed_owner=false; dev domain is gmail.com.
• free_webmail_dev store Developer email busrakaraman256@gmail.com; no verified publisher; no business website confirmed.
• content_scripts_broad manifest content_scripts_matches=[*://*/*]; runs on every URL despite stated cursor-only function.
• no_csp manifest content_security_policy=null; csp_present=false on MV3 extension with broad content script reach.
• external_js_host_yowgames crx js_external_hosts includes yowgames.com alongside chrome.google.com; monetization domain in JS.

Permissions Breakdown

• storage low Used to persist cursor preference; minimal risk on its own.
• content_scripts *://*/* high Injects JS/CSS into every page the user visits; broad DOM access despite narrow declared permissions.

Pillar Scores

Bookkeeping