Top Risks

• Uninstall and install URL hijacks both point to tabplugins.com — confirmed monetization shell pattern.
• Privacy policy is Google's generic account policy — does not scope to this extension at all; rated +10.
• Broad *://*/* host_permissions + scripting on every page with no CSP; max capability reach.
• Free-webmail developer (heroking15@gmail.com) with no verifiable business identity.
• install_perm_anomaly: only 181 installs yet holds HIGH-tier permissions — tail attack surface.

Evidence

• uninstall_url_hijack manifest setUninstallURL → https://tabplugins.com/cursors/ (3rd-party monetization domain).
• install_url_hijack manifest onInstalled opens https://tabplugins.com/genshin-impact-cursor-custom-game-cursor-for-chrome/.
• privacy_policy_generic api Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not extension-scoped.
• host_permissions_all_sites manifest *://*/* with scripting permission — reads/modifies every site the user visits.
• free_webmail_developer store Developer email heroking15@gmail.com; no verified business domain.
• dom_sink_innerhtml crx innerHTML written from variable in main.4964ab1e.js; no CSP mitigation present.
• no_csp manifest content_security_policy is null; MV3 defaults apply but no explicit hardening.
• small_install_high_perm api 181 installs with all-sites+scripting permissions — install_perm_anomaly flagged.

Permissions Breakdown

• storage low Standard local data persistence, low risk.
• unlimitedStorage low Allows unbounded storage; low direct harm but supports large data caching.
• scripting high Enables programmatic script injection into pages; combined with *://*/* very broad.
• *://*/* (host_permissions) high All-sites host access paired with scripting — can read/modify every page visited.
• *://*/* (content_scripts) high Auto-injected on every page; reinforces all-sites capability surface.

Pillar Scores

Bookkeeping