Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Preppy Cursor ★ Custom Cursor for Chrome™ [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall and install URL hijacks redirect to yowgames.com with UTM tracking — classic traffic-monetization shell pattern.
• Privacy policy from yowgames.com explicitly admits data collection and third-party sharing but is not scoped to this extension (+10 privacy).
• Free-webmail dev email (gmail) with no verified business identity; developer name 'wallpaperlive' diverges from yowgames.com brand.
• Content script injected on all URLs (*://*/*) giving per-page DOM access across every site visited.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → yowgames.com with UTM params; traffic-monetization fingerprint.
• install_url_hijack manifest onInstalled opens yowgames.com with UTM params; install-redirect pattern.
• privacy_policy_generic_admits_sharing store Policy fetched from yowgames.com: scope_extension=false, data_collection=true, third_party_sharing=true → +10 privacy.
• free_webmail_developer store busrakaraman256@gmail.com — numbered alias, free webmail, no verified business domain → reputation floor ≥7.5.
• content_scripts_all_urls manifest content_scripts_matches=[*://*/*] injects into every page the user visits.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.
• jquery_3_6_0_bundled crx jquery 3.6.0 detected; no CVEs flagged in cve_findings_raw so no CVE pillar penalty.
• external_host_yowgames crx js_external_hosts includes yowgames.com — same domain as install/uninstall hijack target.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Preppy Cursor ★ Custom Cursor for Chrome™ [adware] + malext.io malicious_extension_sentry; score 5.47 -> 7.97 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Stores cursor preferences locally; minimal risk.
• content_scripts *://*/* high Injects script into every page; broad reach despite being declared via content_scripts not host_permissions.

Pillar Scores

Bookkeeping