Top Risks

• Uninstall URL hijack routes to yowgames.com with UTM tracking on every uninstall.
• Install URL hijack opens yowgames.com on install — monetization/data funnel pattern.
• Privacy policy not scoped to this extension; admits data collection and third-party sharing.
• Free-webmail developer (gmail) with no verified publisher badge — low accountability.
• Content scripts run on every URL (*://*/*) giving broad page-level reach.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL targets yowgames.com with UTM params — traffic monetization pattern.
• install_url_hijack crx onInstalled opens yowgames.com with UTM params — affiliate/monetization redirect on install.
• privacy_policy_not_scoped store Policy fetched from yowgames.com; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email gunaysimge48@gmail.com; no verified publisher badge; developer_domain is gmail.com.
• content_scripts_broad manifest content_scripts_matches: *://*/* injects JS on every HTTP/HTTPS page.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.
• jquery_3.6.0_bundled crx jquery 3.6.0 detected in jquery.min.js; no CVEs flagged in cve_findings_raw.
• js_external_hosts crx Extension references chrome.google.com and yowgames.com as external JS hosts.

Permissions Breakdown

• storage low Used to persist cursor selection preferences; standard low-risk permission.
• content_scripts *://*/* high Content script injected on every site; broad reach for a cursor extension.

Pillar Scores

Bookkeeping