Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Dragon Ball Cursor - Custom Anime Cursor for Chrome [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall+install URL hijack to tabplugins.com — classic traffic-monetization shell pattern.
• scripting + *://*/* grants full page read/write on every site the user visits.
• Privacy policy is Google's generic account policy — does not cover this extension at all.
• Free-webmail dev (gmail), no developer name, numbered alias email (mbilalshah0001) — low accountability.

Evidence

• uninstall_url_hijack manifest setUninstallURL → https://tabplugins.com/cursors/ (3rd-party traffic grab).
• install_url_hijack manifest onInstalled opens https://tabplugins.com/dragon-ball-cursor-custom-anime-cursor-for-chrome/.
• broad_host_plus_scripting manifest host_permissions *://*/* + scripting permission = full DOM control on all sites.
• privacy_policy_generic store Policy URL is Google account privacy page (fetched, scope_extension=false, data_collection=true, third_party_sharing=true).
• developer_identity store No developer name; free-webmail numbered alias mbilalshah0001@gmail.com; no business domain.
• dom_xss_sink crx innerHTML write in main.4964ab1e.js; no CSP declared.
• small_install_high_perm api 590 installs + HIGH-tier permissions = tail attack surface flag.
• verified_publisher_with_webmail store Verified publisher badge present but developer email is free Gmail with numbered alias — low trust signal.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Dragon Ball Cursor - Custom Anime Cursor for Chrome [adware] + malext.io malicious_extension_sentry; score 6.08 -> 8.58 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Stores cursor preferences locally; low risk.
• unlimitedStorage low Extends storage quota; no direct exfil risk alone.
• scripting high Programmatic script injection into all pages via host_permissions *://*/*.
• *://*/* (host_permissions) high Broad host access — pairs with scripting for full page read/write on every site.

Pillar Scores

Bookkeeping