Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Back to School Cursor ★ Custom Cursor for Chrome™ [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall URL hijack redirects to yowgames.com with UTM tracking — traffic-monetization pattern.
• Install URL hijack redirects to yowgames.com on install — confirms monetization shell.
• Privacy policy (yowgames.com) admits data collection and third-party sharing but is NOT scoped to this extension — D clause applies (+10.0 privacy).
• Free-webmail developer (afraezgi4@gmail.com) with no verified publisher or business identity.

Evidence

• uninstall_url_hijack crx setUninstallURL → yowgames.com with UTM campaign params; +3.0 webstore.
• install_url_hijack crx onInstalled opens yowgames.com with UTM params; +2.0 webstore.
• privacy_policy_d_clause store Policy fetched, scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• free_webmail_dev store Developer email afraezgi4@gmail.com; no verified publisher; no business website tied to email.
• content_scripts_all_urls manifest content_scripts_matches=[*://*/*] injects into every page for a cursor-only tool.
• no_csp manifest content_security_policy is null; MV3 mitigates somewhat but no explicit CSP declared.
• js_external_hosts crx External hosts: chrome.google.com, yowgames.com — yowgames.com is operator's monetization domain.
• operator_cluster_gmail store Dev fingerprint anchored to gmail address; sibling_count=0 but install/uninstall hijacks confirm monetization pattern.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Back to School Cursor ★ Custom Cursor for Chrome™ [adware] + malext.io malicious_extension_sentry; score 6.45 -> 8.95 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Stores cursor preference locally; minimal risk on its own.
• content_scripts *://*/* high Runs JS on every page visited; broad reach for a cursor-only extension.

Pillar Scores

Bookkeeping