Top Risks

• Install+uninstall URL hijacks redirect users to third-party marketing pages on every install/uninstall.
• scripting + *://*/* grants arbitrary JS injection across every site the user visits.
• Privacy policy admits data collection and third-party sharing without data retention disclosures.
• No CSP on MV3 extension with broad host access and a DOM-XSS innerHTML sink in bundled JS.
• Extension is cosmetic (cursor theme) but requests full broad host-scripting access — scope mismatch.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL points to tabplugins.com/cursors/ via Google redirect wrapper.
• install_url_hijack crx onInstalled opens tabplugins.com/pinky-cursor with UTM tracking params.
• broad_host_scripting manifest host_permissions *://*/* + scripting permission enables JS injection on all sites.
• no_csp manifest content_security_policy is null; MV3 default CSP applies but no explicit hardening.
• dom_sink_innerhtml_userctrl crx static/js/main.4964ab1e.js: innerHTML assigned from variable — DOM-XSS sink present.
• privacy_policy_third_party_sharing store Policy fetched: scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• js_external_hosts crx Extension references chrome.google.com, reactjs.org, tabplugins.com, www.google.com.
• category_scope_mismatch store Cursor/cosmetic extension with *://*/* host access and scripting — overclaims capability for stated purpose.

Permissions Breakdown

• storage low Stores cursor preferences locally; low risk.
• unlimitedStorage low Extends storage quota; low incremental risk.
• scripting high Allows arbitrary JS injection into all pages via *://*/* host permission.
• *://*/* high Broad host access across all URLs; scripting+all_urls is HIGH×1.2 combo.

Pillar Scores

Bookkeeping