Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Soccer Cursor ★ Custom Cursor for Chrome™ [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall & install URL hijack routing users to yowgames.com with UTM tracking — monetization funnel.
• Privacy policy admits data collection and third-party sharing but is NOT scoped to this extension → +10 privacy score.
• Brand impersonation: mentions Ronaldo, Messi, Mbappé, Barça, Real Madrid without being affiliated → confirmed impersonation.
• Free-webmail developer (gmail) with no verified publisher badge; dev name mismatches privacy policy domain.

Evidence

• uninstall_url_hijack crx setUninstallURL to yowgames.com with UTM params — Webstore +3.0.
• install_url_hijack crx onInstalled opens yowgames.com with UTM params — Webstore +2.0.
• brand_impersonation store brand_mention.is_impersonation=true; confirmed_owner=false; dev domain is gmail.com — Reputation +2.0.
• free_webmail_dev store ayseozkacar237@gmail.com — free webmail, no verified publisher, no business website — Reputation +1.5.
• privacy_policy_generic_admitting_data api scope_extension=false, data_collection=true, third_party_sharing=true → Privacy +10.0 (v3.5 rule D).
• content_scripts_broad manifest content_scripts_matches=[*://*/*] injects into every page; broad reach.
• no_csp manifest csp_present=false; MV3 so no +2.0 network penalty, but v2 calibration MV2 rule not triggered.
• low_rating store Rating 3.0; installs only 918; not enough ratings to trigger +1.0 threshold.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Soccer Cursor ★ Custom Cursor for Chrome™ [adware] + malext.io malicious_extension_sentry; score 5.34 -> 7.84 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Stores cursor preference locally; minimal risk.
• content_scripts *://*/* medium Runs JS on every page visited; broad reach even without host_permissions declared.

Pillar Scores

Bookkeeping