Top Risks

• Uninstall URL hijack sends user to yowgames.com with tracking UTM params — traffic monetization signal.
• Install URL hijack opens yowgames.com on extension install — onboarding redirect to 3rd party.
• Privacy policy (yowgames.com) admits data collection and 3rd-party sharing but is not scoped to this extension.
• Free-webmail developer (gmail) with no verified publisher badge and no business accountability.
• Content script injected on all URLs (*://*/*) despite being a simple cursor extension — broad reach.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → yowgames.com with UTM tracking; classic monetization-shell pattern.
• install_url_hijack crx onInstalled opens yowgames.com with UTM params — 3rd-party redirect on install.
• privacy_policy_generic store Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy.
• developer_identity store Dev email afraezgi4@gmail.com; free webmail, no verified publisher, no featured badge.
• content_scripts_broad manifest content_scripts_matches=[*://*/*] injects into every site despite cursor-only stated function.
• js_external_hosts crx External JS hosts: chrome.google.com, yowgames.com — extension contacts yowgames.com.
• no_csp manifest content_security_policy is null; MV3 strict default applies, no manual CSP declared.
• maintenance store Last updated November 2025; months_since_update=9 → 6-12 month band (+3.5).

Permissions Breakdown

• storage low Used to persist cursor preferences locally; minimal risk.
• content_scripts *://*/* high Injects script into every page the user visits; broad DOM access across all origins.

Pillar Scores

Bookkeeping