Top Risks

• Uninstall URL hijack to yowgames.com with UTM tracking — monetization fingerprint on a tiny-install extension.
• Install URL hijack to yowgames.com — opens 3rd-party page on every install.
• Privacy policy is generic yowgames.com policy (scope_extension=false) admitting data collection and 3rd-party sharing; drives privacy pillar to 10.
• Free-webmail dev (gmail) with no verified business presence; developer domain is gmail.com.
• Content script runs on *://*/* — full-page access on every site despite stated cursor-only function.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → yowgames.com with UTM params; classic monetization shell signal.
• install_url_hijack manifest onInstalled opens yowgames.com with UTM params on every install.
• privacy_policy_generic store Policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true — generic site policy, not extension-scoped.
• free_webmail_dev store Developer email gunaysimge48@gmail.com; no verified publisher badge; developer_domain is gmail.com.
• content_script_broad crx content_scripts_matches=[*://*/*] injects into every page; no host_permissions but same reach.
• no_csp crx content_security_policy is null; MV3 default applies but no explicit hardening declared.
• js_library_jquery_3.6.0 crx jquery 3.6.0 bundled; no CVEs found in cve_findings_raw for this version.
• low_install_monetization store Only 202 installs yet install/uninstall URL hijacks both point to yowgames.com with campaign tracking.

Permissions Breakdown

• storage low Stores cursor preference settings locally; minimal risk.
• content_scripts *://*/* high Injects JS into every page visited; broad reach despite narrow declared function.

Pillar Scores

Bookkeeping